At 11:34 UTC on Saturday, October 31, Ethereum quietly rewrote a single block. Reorgs that shallow happen from time to time and almost nobody notices them, because the replacement block usually contains the same transactions and life carries on. This one contained a 10 ETH deposit to a THORChain vault that never made it into the canonical chain, and by the time the dust settled, a cross-chain exchange handling billions in volume had switched off trading on ten networks.
How 10 ETH Became a Double Refund
The sequence, as THORChain described it and Blockchain Reporter laid out, is a small masterpiece of things going wrong in the right order.
The ghost deposit
THORChain's observers had already seen the 10 ETH deposit and credited it. Then the block holding it disappeared in the reorg. Every node detected the reorg, but the re-check that should have removed the phantom deposit could not return a clear answer in time, so the deposit was finalized as if it were real.
Two refunds, one deposit
The swap attached to that deposit missed its price limit, so THORChain refunded it, paying out against ETH the vault had never received. The sender's real deposit, which did land on chain, was refunded too. One reorg, two outbound payments, one set of collateral.
The circuit breaker
The automatic solvency checker spotted the shortfall and halted ETH swaps. Within about two minutes, node operators stopped ETH transaction signing so nothing else could leave the vaults. Three node votes halted ETH outbound payments, and three more halted every chain as a precaution. ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC went dark, while AVAX, Base, RUNE and XRPL kept running. The user returned the 10 ETH and the vault is solvent again, which is more courtesy than most people in this industry would have shown.
The scariest sentence in the whole episode came from THORChain itself. Now that the bug is public, it warned, every reorg on a connected chain gives a malicious actor the chance to send a new transaction with the same nonce and be paid by the vaults. That is why the chains came back one at a time, as nodes judged each safe, and why RUNE fell 11.4% to $0.542 while Bitcoin and Ethereum barely moved.
The Kill Switch Everyone Just Saw
The detail that made headlines was an accident of timing. THORChain's halt also froze the cross-chain swaps that North Korea-linked launderers had been using to move proceeds from the record $6.3 billion exchange hack of October 29. Chainalysis noted on X that THORChain had "inadvertently delayed" the laundering of a significant amount of stolen funds, since nobody, hackers included, could swap through most of its bridges until service resumed.
Most coverage filed that under happy coincidence. It deserves a harder look. When the previous record theft was laundered last year, a large share of it moved through THORChain's ETH pools, and the protocol's answer to critics was essentially that a neutral, decentralized network could not and should not pick which swaps to stop. An attempt by node operators to pause ETH trading back then was reversed within hours, and the episode cost the project at least one prominent developer.
This weekend, three node votes paused ten chains in minutes, and every regulator and compliance team watching now knows exactly how fast that can happen.
That changes the conversation THORChain will have the next time stolen funds start flowing through it. "We cannot stop it" has been replaced by a public, timestamped demonstration that it can.
The LeveX Take
The market treated the halt as a 10 ETH bug with a funny side effect. The bigger cost is reputational leverage. A protocol that has shown it can stop every chain on a solvency trigger will find it much harder to argue that it cannot stop on a sanctions trigger, and that pressure will arrive from regulators and from the stablecoin issuers and bridges THORChain depends on, several of which just froze billions of dollars of the same hacker's assets within hours. That is a governance fight with no obvious resolution date, and the outcome bears directly on RUNE, whose value rests on swap volume that a more interventionist network could lose to venues with fewer rules.
For traders, the awkward variable is timing. Restarts come chain by chain at the nodes' discretion, the nonce-replay fix has no published date, and a single reorg on any connected network before it lands would reopen the whole question. That kind of exposure, where the direction may be clear and the clock is unknowable, is where Futures Credit earns its place. It can absorb losses up to the credit's value while you keep the profits, which gives a position on the RUNE perpetual a buffer against the restart arriving later than expected. It requires pairing with real funds and expires on a fixed timeline, so it works best as a cushion for a mistimed entry over a short window.
Why Finality Still Bites
Ethereum offers economic finality after roughly two epochs, about 13 minutes, and THORChain, like most cross-chain systems, credits deposits well before that to keep swaps fast. This weekend showed what that trade-off costs when a block disappears, and it is the same tension that sits behind most crypto bridge hacks: every system that moves value between chains has to decide how much "probably final" it is willing to treat as final.
RUNE trades on LeveX as a perpetual futures contract, and ETH is available on spot for the chain at the center of this story. The Crypto in a Minute series explains reorgs, finality and cross-chain swaps in short reads.