Onchain data uncovers a Zcash matching bug that eliminated about 140 RUNE from the bonds of 18 THORChain node operators. User and vault funds were unaffected, and native ZEC trading remains f
Onchain data uncovers a Zcash matching bug that eliminated about 140 RUNE from the bonds of 18 THORChain node operators.
User and vault funds were unaffected, and native ZEC trading remains frozen until a fix ships.
A vault slash was caused by the outbound matching problem. No funds were lost, but trading remains paused until the fix ships in 3.21, the protocol said.
THORChain’s post on the ZEC vault slash, published by @THORChain on X on October 19, 2026.
Operators lock up RUNE as collateral, and their stake takes the hit when a vault fails.
The collateral here covered a software failure. The swappers got away unharmed.
According to its State of the Network report, THORChain’s active set increased from 87 to 103 nodes in September, Cryptopolitan reported. Those nodes’ bond providers will pick up streaming yield in v3.21.
They can send a slice of their bond yield straight to their wallets.
The feature is disabled by default and will be enabled when Mimir switches it on.
The repair will be part of the THORChain v3.21.0 release, according to the protocol’s GitLab post. Its changelog says all outbound matching uses the same shared destination comparator. This means that a Zcash TEX address and its matching transparent address are treated as going to the same place.
ZEC outbounds to TEX addresses are now queued as transparent transactions. When the NU6.3 network upgrade is live, all transparent ZEC outbounds also switch to v6 signing, a fleet-wide change controlled by a HALTSIGNINGZEC control.
The upgrade is set to activate at block 28,366,100, which THORChain expects to happen around 13:40 UTC on Friday, October 23. Release notes say the height is authoritative; the time is inexact.
Operators have to run a private binary with security patches on top. Release notes tell them not to build from source.
The release targets several paused services, including ZEC. Solana trading stopped after a new type of Solana transaction appeared, and v3.21 lets it restart. The release also fixes the App Layer flaw behind the recent attack on Rujira’s FIN contract.
Limit swaps paused due to state bloat can start again as well. Fixed SwapKit affiliate fee payouts allow SwapKit to turn THORChain back on with a number of integrators.
Swaps without memos are priced dynamically against spam, with registration costing more as memo slots fill. Mimir lets them back in once it enables them.
Monero is omitted from v3.21. Its other fixes are pending v3.21.1, which has no date yet.
ZEC pool is one of the newest on THORChain. As Cryptopolitan reported, the 3.20 upgrade came on August 25, 2026.
THORChain said it moved Monero and Zcash closer to activation. A native ZEC liquidity pool launched in early October.
The 3.20 version also reintroduced support for Solana, Base, and BNB. THORChain had reopened on June 23 after a security overhaul that took 11 stages and 39 days to complete following a $10.7 million exploit in May 2026.
If you're reading this, you’re already ahead. Stay there with our newsletter.
