Image Credit: thorchain.org
- THORChain traced a cross-chain trading halt to a refund bug that overpaid ten ether.
- Developers are currently working on software fixes while ten networks remain paused.
- Users should check that intended transaction routes reopen before making any deposits.
THORChain has traced Saturday’s cross-chain trading halt to a refund bug that paid out 10 ETH its vault had never received.
The recipient has returned the extra funds, restoring the vault’s balance. Swaps involving 10 networks remained paused on Monday while developers worked on fixes.
A Dropped Ethereum Block Triggered an Extra Refund
The incident began at 11:34 UTC on Oct. 31, when Ethereum replaced one recent block with another. A 10 ETH deposit in the discarded block had already been credited by THORChain, even though it no longer appeared in Ethereum’s accepted transaction history.
The swap missed the sender’s price limit, triggering a refund. THORChain paid against the invalid deposit, and the sender’s actual deposit was refunded too, leaving the vault 10 ETH short.
A follow-up check was supposed to remove the invalid deposit from THORChain’s records, but it failed to resolve the discrepancy in time. The refund went through anyway.
An automatic balance check caught the shortfall and stopped Ether swaps. Within about two minutes, node operators also stopped authorizing outgoing Ethereum transactions. They then extended the halt as a precaution while developers investigated.
Bitcoin and Nine Other Networks Remain Paused
At 10:20 UTC on Nov. 2, THORChain’s live network settings showed trading paused for Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash.
Avalanche, Base and XRP Ledger trading remained enabled. A swap involving any paused network was still unavailable, even if the network on the other side was open.
For ordinary users, sending funds into a halted connection can leave a payment waiting. Users should check that their intended route has reopened before making a deposit.
The disruption also affected attempts to move funds stolen from Binance. Blockchain analytics firm Chainalysis described the effect on laundering:
“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.”
The pause blocked the same routes for regular traders. It began as a response to the refund error, rather than an intervention targeting the Binance attackers.
Node Operators Decide When Swaps Resume
THORChain’s developers are working on fixes. The team warned that the refund mismatch could be exploited during future block reorganizations, so getting the extra 10 ETH back does not resolve the software problem.
Emergency halts can be triggered by three node votes and overturned by four opposing votes. That gives operators a way to stop activity quickly, without giving those nodes control of the assets held in the vaults.
Node operators will decide when each network is safe to reopen. Each chain has separate pause settings, allowing one connection to resume while others stay closed.
