THORChain Restarts Most Swaps as 14 Nodes Await Upgrade

Network Restoration and Node Upgrade Progress

Decentralized cross-chain liquidity protocol THORChain has re-enabled swap operations for primary networks, including Bitcoin (BTC), Ether (ETH), and Tron (TRX). The trading functions were restored by 5:15 p.m. ET on November 3, 2026, according to historical node records retrieved from THORNode Mimir. The resumption brings major functionality back online following an emergency halt that suspended trading activity across the decentralized ecosystem on October 31.

Public telemetry indicates that the protocol’s recovery is currently progressing through an incremental node rollout. Out of the network’s 111 active validator nodes, 97 have successfully updated to version 3.21.1, while 14 remain on version 3.21.0 as of November 4 at 02:04 UTC (November 3 at 9:04 p.m. ET). Outbound-signing restrictions reflect consistent parameters across all 13 supported external chains. Addressing the operational lag, THORChain attributed ongoing inefficiencies to incomplete validator participation, explicitly noting: “All active nodes need to update to 3.21.1 to fix performance issues with swapping.”

Investigation of the Ethereum Reorg and Protocol Halts

The network disruption originated on October 31 when an Ethereum single-block reorganization exposed an internal refund vulnerability. During the reorg—an event where an alternative valid block replaces a recent one—a THORChain vault mistakenly released an outbound refund of 10 ETH against an inbound deposit that had failed to settle. This discrepancy triggered the network’s automated solvency verification mechanisms, which instantly halted Ether swaps before independent node operators voted to suspend wider trading as a safeguard.

THORChain confirmed that the user involved subsequently returned the 10 ETH to the protocol. To remediate the issue, core contributors distributed release 3.21.1. According to the release documentation, the software patch introduces no underlying consensus changes but directs node operators to install a private binary containing specific security enhancements. Unlike standard hard forks, the patch operates without a coordinated block height, allowing decentralized operators autonomy over local deployments. While key layer-1 assets have been restored, trading for Cosmos Hub and Solana remains restricted, as both chains were already locked prior to the reorg event. THORChain clarified that independent validators will determine when to re-open the remaining paused networks “as they are deemed safe”, offering no guaranteed timeline for full restoration.

Regulatory Scrutiny and Censorship Resistance Debates

The timing of THORChain’s operational restoration intersects with heightened regulatory oversight surrounding illicit cryptocurrency flows. Blockchain analytics firm Chainalysis noted that THORChain’s temporary operational pause had inadvertently slowed efforts by North Korean cyber actors to wash assets stolen in an exploit targeting Binance. The Federal Bureau of Investigation (FBI) issued an alert on October 31 attributing the historic theft of more than $6 billion from Binance to the state-backed TraderTraitor group, formally calling upon THORNode operators and Web3 infrastructure hosts to intercept and freeze any inbound or outbound capital traced to the incident.

The law enforcement appeal collides directly with the decentralized design philosophy governing THORChain. The protocol operates under an open framework, maintaining a public position that it was explicitly engineered to be “permissionless, censorship-resistant, and public.” The network’s decentralized architecture gives core developers the power to publish software recommendations, but individual, globally distributed node operators retain full sovereignty over whether to enforce address blacklists. This governance framework was previously highlighted during the Bitget exchange hack, an incident discussed in an interview with technical co-founder Chad Barraford regarding the protocol’s refusal to institute discretionary wallet bans.

Why This Matters

The technical vulnerability triggered by Ethereum’s one-block reorganization highlights the complex technical dependencies embedded in cross-chain decentralized finance (DeFi). Because cross-chain bridges and settlement platforms rely on finality assurances across diverse external blockchains, minor reorganizations can generate severe cross-network accounting discrepancies if refund logic is not synchronized with strict finality parameters.

Furthermore, the friction between THORChain’s censorship-resistant consensus layer and the FBI’s TraderTraitor advisory signals a critical juncture for decentralized infrastructure providers. As state-sponsored threat actors orchestrate multi-billion-dollar exploits, non-custodial networks are under mounting pressure from global law enforcement to institute transactional compliance measures, testing whether validator nodes can maintain neutrality without exposing operators to legal or regulatory liabilities.

Frequently Asked Questions

What caused THORChain to halt trading operations on October 31?

The emergency pause occurred after a one-block Ethereum reorganization revealed an accounting flaw in THORChain’s refund logic. An outbound vault refunded 10 ETH for a transaction that never finalized, triggering the protocol’s automated solvency checks and prompting node operators to suspend trading across multiple external networks to protect vault integrity.

Which networks are currently operational, and which remain suspended?

Swaps for major assets such as Bitcoin, Ether, and Tron have officially resumed as validator nodes adopt the 3.21.1 patch. However, trading functionality for Cosmos Hub and Solana remains halted, with node operators set to re-evaluate their status once infrastructure security is verified.

Why did the FBI issue a warning regarding THORChain nodes?

On October 31, the FBI issued an alert linking a $6 billion exploit of Binance to North Korean threat actors known as TraderTraitor. The agency requested that THORChain node operators and crypto infrastructure providers identify and block funds linked to the compromise. However, THORChain’s architecture remains permissionless and decentralized, leaving transaction filtering choices entirely up to individual node validators.