What Happens When a Blockchain Shuts Down? Someone Calls the Validators

• Balances and keys survive a clean halt in the last agreed state.
• Solana’s 2021 restart from its last confirmed slot needed at least 80% of active stake.
• Ethereum Classic kept producing blocks through two attacks in 2020 that orphaned more than 7,900 blocks and double spent about $9 million.
• BNB Beacon Chain warned that assets without cross-chain functionality would be permanently lost at its 2024 sunset.
• MiCA Article 75 treats ledger problems outside a custodian’s control as beyond its liability, while segregation and position records keep applying.

“Decentralized chains are not designed to be stopped.” BNB Chain wrote that on 7 October 2022, the day after it stopped one. An attacker had forged a low-level proof against the BSC Token Hub, the bridge between BNB Beacon Chain and BNB Smart Chain, and withdrawn 2 million BNB. The team closed the incident by contacting community validators one by one. BNB Smart Chain ran 26 active validators spread across time zones, and BNB Chain said the spread delayed the closure.

Every halt in the record ends with people coordinating a restart. A stopped chain keeps its balances, and the last agreed state can be rebuilt from surviving nodes and snapshots. What stops is the ability to change that state. Transfers, liquidations, governance votes and bridge messages all wait, and the decision about which state counts passes from the protocol to whoever can gather enough stake to act. Immutability holds while consensus runs. Once consensus stops, governance takes over, and the halt shows exactly who holds it.

Buy bitcoin and stocks. Signup to Coinbase today

Liveness failures and safety failures in consensus

BFT-style chains are built to stop. The CometBFT specification states that “any 1/3+ coalition of validators can halt the blockchain by not broadcasting their votes,” and its safety proof assumes less than a third of voting power is Byzantine. A chain in that family that loses quorum freezes on its last committed block. Ethereum’s proof-of-stake design runs the same arithmetic with more steps. A third of stake withholding attestations prevents finality, conflicting finality needs an attacker willing to have 34% of stake slashed, and a 66% supermajority can finalize whatever history it likes. When a third of stake simply goes dark, the inactivity leak bleeds the stake of non-attesting validators until the remainder holds a two-thirds majority again and finality resumes.

Sui ran the safe version on 14 January 2026. An edge-case bug in consensus commit logic left validators deriving different commit outputs, and more than a third of stake signed a different checkpoint digest. Certification became impossible, and validators halted for about six hours to avoid finalizing inconsistent state. Reads kept serving the last certified state, and no certified transaction was rolled back.

A proof-of-work chain under majority attack keeps producing blocks, and the damage lands on history that counterparties had already treated as settled.

Balances, keys and pending transactions during a halt

A self-custody holder loses nothing in a clean halt. The private key still signs, and the balance still sits in the last accepted state. The holder simply has nowhere to send the next transaction. Anything sitting in a mempool when blocks stopped can vanish, and anything in a block that never reached finality can be reorganized away at restart.

Solana’s February 2024 recovery shows where that line falls. Validators picked slot 246,464,040, the highest optimistically confirmed slot available, prepared snapshots from it and restarted the cluster there on patched binaries. Whether a given transaction survived depended on where it stood relative to that slot.

Custodial users sit behind a second gate. An exchange can keep its internal order book open while it stops deposits and withdrawals on the affected chain, and balances keep trading as ledger entries with no way out.

Layer-2 networks add another tier. Arbitrum’s sequencer issues sub-second soft confirmations that depend on the sequencer behaving honestly, and hard finality arrives only once batches finalize on the parent chain. If the sequencer goes offline or censors, a user can push a transaction through the Sequencer Inbox’s forceInclusion method after a censorship window of up to 24 hours. Chainlink describes that route as more complex and costly, an unfair advantage for whoever can bypass the sequencer, and a liquidation bot with its own parent-chain infrastructure fits the description.

Base halted block production for roughly two hours on 25 June 2026 after an invalid block. The team told ecosystem node operators to restart their nodes once internal nodes were syncing again, with the root cause still under investigation.

How Solana restarted after the 2021 and 2024 outages

At 12:00 UTC on 14 September 2021, Grape Protocol’s IDO went live on Raydium and bots flooded the network. Forwarder queues grew without bound, block producers proposed competing forks, and validators ran out of memory and crashed. On restart they could not process the forks fast enough to catch up. Engineers spent about 14 hours writing mitigation code. The community proposed a hard fork from the last confirmed slot, a step that requires at least 80% of active stake, and more than 1,000 validators upgraded and restarted within two and a half hours of the patch release. Full functionality returned at 05:30 UTC on 15 September after 17 hours offline, with no funds lost.

The future of finance is here. Trade crypto and more

February 2024 ran faster. Block finalization stopped at 09:53 UTC on 6 February, when a deploy-evict-request cycle in a legacy loader program triggered an infinite recompile loop in the JIT cache. More than 95% of cluster stake was running version 1.17, and nearly all validators stalled on the same block. Restart binaries went out at about 12:34 UTC and consensus resumed at 14:55. The same bug had taken down Devnet the week before.

Each restart preserved history and needed a supermajority of stake to install one core team’s patch inside a few hours. The 2024 halt happened because nearly all of that stake already ran a single release.

Emergency halts at Terra, BNB Smart Chain and Cosmos EVM chains

IOTA’s Coordinator was a literal off switch, run by the foundation. Halting it on the day of the Trinity compromise stopped further thefts from compromised seeds while users moved to new ones.

Terra’s validators halted because the token securing the chain had fallen far enough to make a governance majority cheap to buy, turning a price collapse into a protocol-security problem. Terraform Labs said the decision followed “severe $LUNA inflation and a significantly reduced cost of attack,” and that delegations would stay disabled once blocks resumed.

On 24 August, Cosmos Labs said it had advised the Cosmos EVM chains in contact with it to request that validators halt their chains. KiiChain, TAC and MANTRA had already disclosed incidents tied to the module, and MANTRA’s halt ran about 30 hours. Two days later Cosmos Labs told any chain running a version below v0.6.2 or v0.7.2 to halt immediately. The advice that stopped those chains came from the maintainer of a module they shared.

Ethereum Classic’s 51% attacks in 2020

Ethereum Classic kept producing blocks through both attacks. Coinbase’s alert fired at 11:10 PM PST on 31 July 2020, thirteen minutes after the first attack began. The reorganization orphaned 3,692 blocks and added 3,287, and the attacker held majority hashpower for about 13.7 hours. About 800,000 ETC, worth roughly $5.8 million, was double spent across 53 orphaned transactions. The second attack began at 8:15 PM PST on 5 August, orphaned 4,244 blocks over about 18.1 hours and double spent about 460,000 ETC, or $3.2 million.

Pruned Parity nodes treated blocks past a certain depth as ancient, rejected the reorganization and kept mining a separate chain, and Coinbase’s own pruned nodes saw different blocks from its Geth and non-pruned Parity nodes. Coinbase followed the canonical chain and raised its confirmation requirement after each attack, crediting no double spends, and it recommended switching to a supported node such as Geth. By 8 August its confirmation time for incoming ETC stood at about two weeks.

A two-week confirmation window closes a chain to payments while its blocks keep arriving on schedule.

Liquidations, oracles and bridges after a restart

DeFi takes the worst of a halt at the moment it ends. While blocks are stopped, borrowers cannot add collateral and liquidators cannot act, and centralized venues keep repricing the same assets. Restart opens every position at once against prices that moved during the gap. The first blocks fill with liquidations that would otherwise have been spread across hours.

Buy bitcoin and stocks. Signup to Coinbase today

The feed reports 0 when a layer-2 sequencer is up and 1 when it is down, with a timestamp for the last change. Chainlink’s example contract makes an application wait out a grace period after recovery before it accepts price data again, a delay meant to prevent mass liquidations. Queued transactions execute in arrival order after a restart, so the status update lands ahead of the user transactions that depend on it.

Bridges carry finality assumptions about two chains at once. A bridge that mints on the destination chain against a deposit later reorganized away on the source chain is left holding a claim with nothing behind it. The BNB Token Hub exploit itself ran through a bridge’s proof verification. Any protocol accepting a bridged asset as collateral inherits the source chain’s halt and reorganization risk along with the token.

Retiring BNB Beacon Chain and TradeLens

BNB Beacon Chain stopped processing transactions at block 384,544,850 at 06:00 UTC on 19 November 2024, the height set for its final sunset hard fork. Cross-chain communication with BNB Smart Chain ended at the same point, and BNB Chain kept the history reachable through RPC nodes, snapshots uploaded to Greenfield and a live explorer. Its warning to holders said assets without cross-chain functionality “will be permanently lost.”

The token recovery dApp handles only cross-chain bound or mirrored BEP2 and BEP8 assets, asks the holder to sign with the Beacon Chain wallet, and holds each recovery for seven days before the tokens arrive on BNB Smart Chain. Then the recovery tool started a sunset of its own. On 1 July 2026 BNB Chain discontinued the hosted tool, and holders now run an open-source tool locally, generate the payload themselves and call the recover function on the BNB Smart Chain contract by hand. The phase three notice names no final cutoff.

TradeLens was retired on commercial grounds. IBM and Maersk announced the shipping platform in 2018. On 29 November 2022 they said they would withdraw it, and Maersk’s statement said “full global industry collaboration has not been achieved” and that the business had not reached the commercial viability needed to continue. It was due offline by the end of the first quarter of 2023.

Rollbacks, restarts and the DAO fork

A restart from the last agreed state leaves history alone, and the record holds one clean example of the alternative. Block 1,920,000 on 20 July 2016 carried an irregular state change that moved about 12 million ETH out of the Dark DAO and Whitehat DAO contracts into a WithdrawDAO recovery contract. Roughly 85% of miners followed the fork. Clients could stay on the old rules with an oppose-dao-fork flag, and that chain became Ethereum Classic, the network attacked in 2020.

Terra’s 2022 answer was a new genesis. Proposal 1623 passed on 25 May with about 65% of votes in favor and created a new chain. Its LUNA went 35% to pre-attack LUNA holders, 10% to pre-attack UST holders, 10% to post-attack LUNA holders, 15% to post-attack UST holders and 30% to a community pool. The old chain continued as Terra Classic. Snapshot heights pick the winners in a design like that, and no technical step restores the value the old token lost.

Ethereum’s proof-of-stake documentation calls the social layer the “ultimate backstop” for the worst attacks, and expects 34%, 51% or 66% attacks to need out-of-band social coordination, with the community agreeing to adopt an honest fork. That puts exchanges, custodians and node operators inside the recovery mechanism.

Compound III’s Pause Guardian is an address designated by COMP holders and held by the Community Multi-Sig, and it can pause supply, transfer, withdraw, absorb and buy collateral operations. A pause like that stops one protocol while the base chain keeps running, and the signer set behind it becomes part of the protocol’s security perimeter.

The future of finance is here. Trade crypto and more

Custody duties during a chain halt under MiCA, DORA and New York rules

Under MiCA, a chain halt suspends settlement and leaves the custodian’s obligations running. Article 75(8) makes a custodial CASP liable for losses from incidents attributable to it, capped at market value. It gives a problem inherent in the operation of the distributed ledger the provider does not control as an example of an incident outside that liability. A permissionless chain stalling on a client bug fits the description, and a key the custodian lost stays squarely inside the liability.

Article 75(2) requires a register of positions for each client. Article 75(4) covers forks directly, entitling the client to newly created crypto-assets or rights in proportion to its positions when the underlying ledger changes, unless a custody agreement signed beforehand says otherwise. Article 75(7) keeps client assets legally segregated from the provider’s estate, beyond the reach of its creditors in insolvency. A custodian wanting discretion over fork recognition has to write it into the contract before the fork.

DORA has applied to crypto-asset service providers since 17 January 2025. The AMF’s summary lists a comprehensive ICT business continuity policy with backup, restoration and recovery procedures tested annually, plus crisis communication plans for inside and outside the firm. A procedure for a halt on a chain the firm depends on belongs in that tested set.

New York’s Department of Financial Services updated its custody guidance on 30 September 2025. The industry lettertells custodians to segregate customer virtual currency from corporate assets, keep equitable and beneficial interest with the customer, avoid any debtor-creditor relationship, and stand ready “at all times” to reconcile their books against on-chain activity. Against a halted chain, that reconciliation runs to the last agreed state, and a fork forces the crypto custodian to pick a history first.

The Property (Digital Assets etc) Act 2025 received Royal Assent and came into force on 2 December 2025. Section 1 says a digital or electronic thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action. A token stranded on a halted chain can still be property in English law. FCA custody rules for crypto firms sit in CASS 17, part of a regime whose full scope begins on 25 October 2027.

Federal rules for crypto custody in the US are still in draft. The SEC’s proposal appeared in the Federal Register on 6 October 2026 with comments due 7 December 2026. The Senate failed to advance the CLARITY Act on 15 September 2026.

A chain-failure policy for exchanges and custodians

A workable policy comes down to seven written decisions, made before the next halt.

• Run independent nodes on more than one client. Coinbase caught the 2020 partition because its own nodes disagreed with each other.
• Set confirmation depth by each chain’s observed security, and raise it automatically on deep reorganizations or stalled finality.
• Separate a trading halt from a deposit and withdrawal halt, and fix in advance which one each failure type triggers.
• Write fork recognition into the custody agreement, since MiCA lets a prior agreement override the default entitlement to newly created assets.
• Give liquidations a grace period after any restart, keyed to sequencer or chain health feeds.
• Track sunset deadlines and the life of the recovery tools along with the chain. BNB Beacon Chain’s recovery path changed form 19 months after the chain stopped.
• Keep keys and records for delisted assets, since BNB’s recovery flow still asks the holder to sign with the old Beacon Chain wallet.