THORChain Suspends Operations in 10 Networks Due to Ethereum Block Reorganization

The cross-chain protocol THORChain has suspended operations across 10 blockchain networks following an Ethereum block reorganization that mistakenly paid a user 10 ETH. The funds were subsequently returned, but the team continues to work on addressing the vulnerability.

The incident occurred on October 31, 2026, at 11:34 UTC. In the Ethereum network, a block reorganization took place, causing a 10 ETH deposit transaction not to be included in the final chain. Meanwhile, THORChain had already recorded the receipt of the assets in the vault's balance.

Since the exchange did not meet the set price limit, the protocol initiated a refund. As a result, the user received 10 ETH from THORChain reserves, even though the initial deposit had not actually been made. The sender also got back the original assets.

The automatic solvency check system detected the discrepancy and halted Ethereum exchanges. About two minutes later, node operators blocked outgoing transactions and then suspended operations in other networks for investigation.

Later, the user voluntarily returned the 10 ETH, restoring the vault's solvency.

Status and Risks

According to the team's statement on November 1, exchanges remained accessible through Avalanche, Base, RUNE, and XRP Ledger. Restrictions were in place for 10 networks, including Bitcoin, Ethereum, Solana, BNB Chain, and Litecoin.

The developers warned that the identified issue potentially allows attackers to exploit a similar block reorganization to receive unwarranted payouts from the protocol's reserves.

The team is working on fixes. Node operators will decide on the resumption of operations for each direction after assessing security.

Recall that in May 2026, THORChain had already suspended trading following a suspected hack amounting to over $10.7 million.