THORChain is keeping Zcash (ZEC) trading halted until its next network upgrade, after a bug led to a slash of about 140 RUNE across 18 node accounts, The Defiant reported on 19 October, citing onchain records. The halt is visible in the network’s own settings: at 16:45 UTC on 19 October the THORNode API showed both ZEC trading and ZEC transaction signing switched off. The fix ships in version 3.21, which developers have proposed for block 28,366,100, estimated for Friday 23 October from about 13:40 UTC.
The same upgrade carries a base-layer patch for Rujira, the application layer that runs on THORChain and has been frozen since an exploit found on 26 September. So two of the cross-chain exchange’s open problems hang on the same block height.
THORChain’s own settings show ZEC halted, and Solana too
THORChain steers halts through Mimir, a set of on-chain switches that node operators vote on. In the Mimir values read on 19 October, HALTZECTRADING and HALTSIGNINGZEC were both set to 1, which stops swaps into and out of ZEC and stops nodes from signing outgoing Zcash transactions. The inbound addresses endpoint listed the ZEC chain as halted with trading paused. Liquidity providers were not locked out: blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">LP actions on ZEC were not paused.
Zcash is not alone. Solana trading is halted as well (HALTSOLTRADING at 1), though Solana signing is not, and the Cosmos Hub chain is halted outright. A global switch for CosmWasm smart contracts, HALTWASMGLOBAL, was also on, which is where Rujira’s applications live. Node churn, the regular rotation of the validator set, is halted too.
About the slash itself, little is public. The Defiant’s report gives the amount and the number of nodes and says the fix is scheduled for v3.21. It does not give the date of the slash, a detailed cause or a dollar value, and THORChain has not published a post-mortem that we could find. Its developer announcement channel does not mention ZEC at all.
A change to how outbound payments are matched
THORChain nodes hold the network’s funds in shared vaults and sign the payments that leave them. When an outbound transaction does not match what the network scheduled, the nodes that signed it lose part of their bonded RUNE. That is the slash. A bug in that matching logic can punish nodes for legitimate payments.
The v3.21.0 release notes, published on GitLab on 15 October, include a change to exactly that area: outbound matching now uses one shared comparison of destination addresses, which treats Zcash TEX addresses and ordinary transparent addresses as equivalent. A TEX address is a Zcash format that only accepts funds from transparent addresses. The notes do not say this was the bug behind the slash, so we do not claim it was.
ZEC payouts to TEX addresses will now be scheduled as transparent payments. Nodes will also sign transparent ZEC transactions in version 6 (ZIP-229) once Zcash’s NU6.3 upgrade is active, and in version 5 until then. That version switch is gated by HALTSIGNINGZEC: operators keep it on until every node runs the new build, then lift it. ZEC signing therefore needs a separate step after the upgrade, not just the block. The state migration also includes “historical slash-refund corrections”, with no detail on which slashes are concerned.
The rest of the changelog is mostly plumbing. It adds guards against paying the same UTXO outbound twice, hardens Monero key generation and signing as a follow-up to a Least Authority audit, and reworks how Solana payouts pick a blockhash, with durable-nonce payouts behind a switch that is off by default.
Zcash had barely arrived on THORChain
The ZEC pool opened on 2 October after a routine node churn, with all nodes watching the Zcash chain, KuCoin News reported. Deposits for liquidity providers were open but direct swaps were not, and the team called liquidity shallow and asked users to trade with caution. September’s preparation covered UTXO management, ZEC transaction timeouts, signing coordination between nodes and a dedicated price oracle.
ChainCatcher reported around 9 October that native ZEC swaps had started as a soft launch, with a warning that trading could be paused if problems appeared. Coindaro could not confirm that date. Either way, the halt comes within weeks of the pool opening. Our Zcash coin page covers how the network works, and a separate route for ZEC swaps, through NEAR Intents, raises its own questions in our report on quantum-safe Zcash swaps.
Rujira: one position exploited, app layer frozen since late September
Rujira found the exploit on 26 September. An attacker transferred a custom concentrated-liquidity position in Rujira’s FIN exchange contract without holding a matching position. Rujira blames the position transfer function, not the strategy’s trading logic, and says only one position, owned by its own team, was affected and “no user funds were lost”, KuCoin News reported on 19 October. Node operators, with Rujira’s support, then suspended the application layer, which stops Rujira’s contracts without touching THORChain’s base swaps.
According to Rujira, the fix sits in THORChain’s base layer and was already slated for v3.21 when it said so on 27 September. The public GitLab notes do not list it. They do warn that v3.21 is a private binary carrying additional security patches, and operators are told not to build it from source.
Earlier, on 9 September, THORChain developers had described a separate CosmWasm weakness linked to MsgStoreCode, the permission to upload contract code, which the Rujira team holds when HALTWASMGLOBAL is off. They said a patch would go out shortly. Nobody has publicly tied that issue to the 26 September exploit.
Once the application layer restarts, trading, lending, borrowing and automated strategies on Rujira should resume. Rujira proposed on 15 October a conditional 24-hour pause: credit accounts with a loan-to-value ratio above 100% that qualify for liquidation at restart would stay frozen one more day, so their owners can add collateral through Rujira Borrow or by sending assets to the account address. Positions still unsafe after that window can be liquidated.
Upgrade v3.21: block 28,366,100 on Friday, if two thirds of nodes vote yes
THORChain developers asked node operators on 18 October at 19:17 UTC to vote yes “now”. The proposal needs two thirds of active nodes. The block height is the binding part. The developers’ call puts it on 23 October between 13:40 and 15:30 UTC, while the GitLab notes stretch the estimate to 16:15 UTC, depending on block times of 6.12 to 6.26 seconds.
Because the image is private, nodes that want to review the patch first can send an encryption key and receive the code from developers or THORSec, together with instructions to check the build hash.
| Item | Figure | Source |
|---|---|---|
| ZEC pool opened to liquidity providers | 2 October 2026 | KuCoin News |
| RUNE deducted in the ZEC slash | About 140 RUNE, 18 node accounts | The Defiant, citing onchain records |
| Rujira exploit discovered | 26 September 2026, one position (Rujira team) | Rujira, via KuCoin News |
| v3.21.0 published on GitLab | 15 October 2026, 04:37 UTC | THORChain GitLab |
| Upgrade height | Block 28,366,100 | GitLab release, THORChain dev channel |
| Estimated window | Friday 23 October, from 13:40 UTC (end 15:30 or 16:15 UTC) | Dev channel, GitLab release (estimates) |
| Votes needed | Two thirds of active nodes | THORChain dev channel |
| Proposed liquidation grace period | 24 hours, for accounts above 100% LTV | Rujira proposal of 15 October, via KuCoin News |
The release notes contain Solana and Zcash signing changes, but trading halts are Mimir switches that operators lift separately. The reopening of each market may therefore come after the upgrade rather than at the block itself.
Second THORChain security halt of 2026
The ZEC slash is small next to what happened in May. On 15 May THORChain halted trading and signing after unauthorized outbound transactions drained one of its six Asgard vaults. The Defiant put the loss at $10.7 million and CoinDesk at about $10.8 million. The same day, developers said a newly churned node was believed to be linked to the attack, and validators later voted to ban it. Version 3.19, proposed for 9 June, was part of the recovery, and global signing was switched back on around 21 June.
Cross-chain swap systems have had a rough October. The NEAR Intents team published a post-mortem on a deposit bug, which we covered in our report on the $3.8M NEAR Intents exploit, and the wider tally of thefts is in Hacken’s Q3 hacks figures.
Next dates: the node vote on v3.21 this week, block 28,366,100 from about 13:40 UTC on 23 October, then the separate votes to lift the ZEC signing and trading halts and to restart Rujira. Neither THORChain nor Rujira has given a date for a full post-mortem.