THORChain Restarts Its Halted App Layer Today at Block 28,366,100 — RUNE's 0.6310 Line Decides 0.7300 or 0.5699

THORChain halts at block height 28,366,100 today — the window the network published is 13:40 to 15:20 UTC — and when it comes back it will be running v3.21, the release that switches back on almost everything the protocol turned off over the last month: Solana trading, Zcash trading, limit swaps, and the App Layer that Rujira's trading, lending and borrowing products live inside.

That is an operating catalyst, not a supply one. The upgrade does not change RUNE's token economics. What it changes is how much of THORChain's own product surface can be used again after a 27-day stretch in which a large part of it could not.

What v3.21 actually turns back on

Solana trading resumes because v3.21 adds support for the new Solana transaction format that halted it. Zcash resumes after fixes to how ZEC outbounds are matched. Limit swaps come back after the release fixes the bug that bloated THORChain's state: orders that ran out of funds were never closed, so the network retried them every block and stored each attempt's error message until roughly 670 open orders were carrying about 57 MB of error history. Underfunded orders now settle instead of retrying, and the stored error history is capped.

The App Layer gets two changes it needs before node operators can restart it: an extra one-block delay is removed from the scheduler, and the X / EXEC memo path — the route that let a Layer 1 transaction execute a THORChain Wasm contract directly — is retired. The release notes state the build ships as a private binary containing additional security patches.

Two other pieces matter for revenue rather than uptime. Affiliate fees, REVSHARE and preferred payout settings are now tracked separately for every integration, which the release notes say lets SwapKit switch THORChain back on for its partners. And bond providers get Bond Yield, a share of future rewards paid out at every churn in RUNE to their own address, a THORChain address or a THORName they own, with the remainder automatically rebonded. The feature ships disabled and goes live once enabled through Mimir.

The upgrade also carries a one-time state migration: it reverses a historical bond slash that hit 218 bond providers, reconciles Secured-Ops liquidity donations, restores the ETH.THOR pool, and retires the synthetic assets of seven low-utilization pools. Memoless swaps return with new spam protection, YUM is whitelisted on the Ethereum token list, and the Monero integration moves a step closer on signing, recovery and operational readiness — though XMR activation is explicitly gated behind a follow-up v3.21.1 and will follow the usual soft launch with shallow liquidity in its first weeks.

Why the App Layer was dark in the first place

Rujira reported on 26 September that an attacker had transferred a custom concentrated liquidity position without owning it. The team traced it to a flaw in the position-transfer function rather than to CCL's trading logic, said only one position — its own — was affected, and said no user funds were lost. It paused the App Layer with node operators' support, and on 27 September said the fix was at the base layer and already scheduled for v3.21.

Shipping the fix is not the same as unpausing. Reopening requires a separate step from node operators, who have to lift the halt. Rujira said on 15 October that if any Credit Account position is above 100% loan-to-value and eligible for liquidation when the App Layer is ready to resume, it will ask operators to keep the Credit Account contract paused for another 24 hours so borrowers can add collateral. Its 10 October warning still stands: positions that are unsafe after the grace window can be liquidated once a liquidator triggers the process.

What RUNE did while the lights were off

The market's first reaction to the exploit was not a sell-off. On 26 September RUNE ran 18.3% intraday to 0.7750 on 42.7 million tokens — 4.2x the previous session and the heaviest print in the last 60 days — then printed the top of the whole move at 0.8450 on 27 September. From there it gave back 27.2% to 0.6150 on 15 October while the App Layer stayed paused.

The session before this upgrade is the one worth studying. On 22 October RUNE pushed to 0.7120 — nine ticks above the 0.382 retrace of the 0.8450-to-0.6150 decline at 0.7029 — and then gave the entire push back, closing at 0.6430 on 19.5 million tokens, about 8x the 21 October volume. It is trading at 0.6430 into the upgrade block. That is a market that has been told the fix is coming and has already refused to pay up for it once.

The three levels that decide the rest of October

0.7120 is the gate. It is both the 22 October rejection high and the shelf where the 0.382 retrace sits at 0.7029, so a close above it is the first evidence the restart is being bought rather than sold. The ladder above that is 0.7300 (the 0.5 retrace), 0.7750 (the 26 September spike high) and 0.8450 (the 27 September top).

0.6310 is the line. It held as the 22 October low and it is the last higher low before the October floor, which makes a daily close below it the cleanest signal that the market intends to treat a working App Layer as sell-the-news.

0.6150 is the floor. It is the 15 October low, 27.2% under the top of the move, and the level everything since 27 September has been measured against. Losing it opens the 0.618 extension of the same 0.2300 range from the 0.7120 rejection at 0.5699, with nothing in the 60-day record to catch the price in between.

What would invalidate the case

Four things. The halt height slips and the upgrade does not land in today's window. The upgrade lands but node operators do not lift the App Layer pause, which would leave Rujira's contracts dark despite a fixed base layer. Forced selling appears in that 24-hour liquidation grace period, which would hit the bid at exactly the moment attention is highest. Or swap volume simply does not return — because v3.21 changes what the network can do, not how much RUNE exists, and an upgrade that restores capacity without restoring flow leaves the price with nothing to hold.

Block 28,366,100 is the number to watch today. The interesting trade is not the upgrade itself but whether 0.6310 holds on the first daily close after the App Layer comes back.