# THORChain Warns Reorg Flaw Could Trigger Repeat Vault Payouts By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/47020 Published: 2026-11-02T23:09:57.000Z Updated: 2026-11-02T23:09:57.000Z Section: Technology > An Oct. 31 Ethereum rollback led to a 10 Ether (ETH) shortfall before the user returned the funds; the protocol paused swaps across chains. In a Nov. 1 warning, THORChain said the incident revealed a refund weakness that could let someone use a replacement transaction with the same nonce to collect funds from vaults on another chain. At 7:34 a.m. ET (11:34 UTC) on Oct. 31, Ethereum’s history shifted back one block, removing a deposit THORChain had already recorded. The swap missed its price limit. THORChain refunded the failed swap and also returned the sender’s original deposit, leaving a vault 10 ETH short. An automatic solvency checker halted ETH swaps. Within about two minutes, node operators stopped signing ETH transactions, then paused all chains as a precaution. The user returned the 10 ETH, restoring the vault’s solvency, while developers worked on fixes. In its Nov. 1 update, THORChain listed 10 networks as halted, with Avalanche, Base, RUNE and XRP Ledger listed as trading. Node operators would decide when each network was safe to re-enable. The [pause affected THORChain swap routes](), not the operation of the underlying blockchains. THORChain’s protocol team warned: “A malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.” Chainalysis said the pause delayed laundering of a significant amount of funds stolen from Binance and prevented users, including North Korean money launderers, from swapping through most THORChain bridges. ## Links in this article - [pause affected THORChain swap routes](https://www.tokenpost.com/news/technology/45972)