An outbound matching bug cost 18 node operators about 140 RUNE in bonds, and native Zcash trading stays paused until the v3.21 upgrade
THORChain has paused native Zcash swaps after a bug cut into the bonds of the operators who run its network. Onchain records show about 140 RUNE deducted from 18 node accounts.
The protocol says no user or vault funds were lost. The people who absorbed the damage were the node operators, which is roughly the outcome a bonded security model is built to deliver.
The trouble traced back to how THORChain matches outbound ZEC transactions. An outbound transaction is the protocol sending coins back out of its vaults to a user once a swap settles, and that matching step is where the bug sat.
Something in that process went wrong, and the network treated it as a vault slash, penalizing the nodes responsible for it.
The incident occurred around October 19, 2026. The penalty came out of bonds, the RUNE that node operators lock up as collateral for the privilege of running the network.
Swappers came out clean. THORChain stated that user and vault funds were untouched, so anyone holding liquidity or trading through the protocol did not lose money because of this.
ZEC swaps will stay frozen until a fix arrives in the v3.21 network upgrade. That upgrade is expected around block height ~28,366,100, which lands on October 23, 2026.
Native ZEC support on THORChain is very new. The liquidity pool launched on October 2, 2026, and a soft launch brought full swap functionality online by October 7-8, 2026.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
So the halt arrived less than two weeks after swaps went live.
The integration supports transparent UTXOs and Zcash’s NU6.3 upgrade. Transparent UTXOs are the publicly visible side of Zcash, which works much like Bitcoin ’s accounting model, as opposed to the shielded transactions that give Zcash its privacy reputation.
Instead of minting synthetic IOUs on another chain, THORChain holds real coins in decentralized vaults and moves them directly between networks, removing the bridge-and-wrapper layer that has caused so much grief across DeFi.
The ZEC halt is not THORChain’s only October headache. On October 9, Tether temporarily blacklisted approximately 1.45 million USDT spread across four of THORChain’s TRON vaults.
That freeze disrupted related swaps and liquidity provision actions for around three hours.
The two incidents have different causes. The Tether episode came from an outside issuer exercising its power to freeze funds, while the ZEC problem came from THORChain’s own code.
The most important detail for users is the one that did not happen. No user funds were lost, and the losses that did occur fell on bonded operators, which is how the system is supposed to absorb faults.
For node operators, the episode is a reminder that their bond carries real risk. A software bug, rather than malicious behavior, triggered this slash.
The things to watch are concrete. First, whether v3.21 ships around block height ~28,366,100 on October 23, 2026, as expected. Second, whether ZEC swaps come back without further slashes. Third, whether THORChain shares more detail on what went wrong in outbound matching.