The THORChain solvency checker triggered an emergency pause halting Ethereum transaction signing within two minutes of detecting a vault shortfall

Overview Debates Related claims Topics

On October 31, 2026, an Ethereum block reorganization triggered THORChain solvency checks after 10 ETH were refunded, leading operators to suspend trading on 10 of 13 connected blockchains on November 1, 2026

The multi-chain withdrawals during the October 29 Binance hack compromised Binance's internal transaction signing infrastructure rather than leaking the underlying private keys

Binance's initial public investigation into its October 29, 2026 hack stated that a compromised DevOps engineer's laptop allowed an attacker to access a service container and execute unauthorized withdrawal transactions

On the Saturday following the October 29, 2026 Binance hack, THORChain node operators halted trading across multiple chains after an Ethereum block reorg caused THORChain to pay out 10 Ether that its vault had not received

Arbitrageurs who rebalance THORChain's Asgard vaults after large North Korean asset swaps frequently use Binance as their source of trading liquidity

Binance publicly stated that its investigation into the October 29 hack found no evidence of any hot wallet private key leaks

Individuals cannot deploy a THORChain node without first receiving approval through the protocol's whitelisting process

THORChain's emergency halt mechanism required only three node operator votes to suspend signing across Cosmos, Bitcoin Cash, BNB Smart Chain, Bitcoin, Dogecoin, Litecoin, Solana, Tron, and Zcash

Following Binance's initial statement attributing the October 29 breach to a single laptop, Binance issued an update stating that investigators had uncovered additional points of breach

A March 17, 2021 firmware migration error caused Coinkite Coldcard devices to run seed generation on a software generator instead of hardware, producing weak recovery phrases

Using a 128-character passphrase on a Trezor device requires both the latest Trezor Suite app and updated device firmware, while older Trezor firmware retains a 50-character limit

Attackers reconstructed weak Coldcard recovery phrases to access wallets, but users with strong, unique passphrases were protected from the Coldcard attacks

Galaxy Digital's Alex Thorn estimated that the Coldcard seed vulnerability resulted in over 1,596 BTC stolen across roughly 7,300 addresses, totaling over $100 million in losses

Trezor stated that increasing Trezor's passphrase length was prompted by user inquiries following the July 2026 Coldcard seed generation flaw

Blockstream CEO Adam Back stated that Liquid Network refreshed peg-out authorization keys, moved them to cold hardware wallets, and completed third-party security audits

Trezor warned in August 2026 that length alone does not guarantee entropy because automated cracking tools systematically test dictionary words, leaked passwords, and common patterns

Trezor designated Trezor's passphrase feature as an advanced feature and warned users that a mistyped or forgotten passphrase can result in lost funds

On August 2, 2026, X account BTC Sessions reported the first confirmed loss from the July 2026 Coldcard seed flaw thefts involving a device using a weak two-word passphrase

Coinkite advised that Coldcard wallets were vulnerable unless created with 50 independent dice rolls or protected by a strong, unique passphrase

Trezor stated in August 2026 that its own hardware wallets were unaffected by the July 2026 Coldcard seed generation flaw, but advised users to move wallets created on a Coldcard and restored on a Trezor