THORChain Hit by $10.8M Multi-Chain Exploit, RUNE Drops 12%

Decentralized cross-chain liquidity protocol THORChain was struck by a suspected exploit on Friday, May 15, with losses estimated at roughly $10.8 million across four blockchains, prompting the protocol to halt all trading and signing operations.

What Happened

Blockchain investigator ZachXBT and security firm PeckShield detected signs of simultaneous exploits across multiple networks, identifying suspicious addresses on both the Bitcoin network and EVM-compatible chains. The attack spanned four separate ecosystems:

• Bitcoin (BTC), Ethereum (ETH), Binance Smart Chain (BSC), and Base
• Attacker wallets currently hold roughly 3,443 ETH, 36.85 BTC, and 96.6 BNB
• The attack has not been officially confirmed and remains under investigation

THORChain's Mimir governance module flipped trading halt and signing halt parameters to active, with a node pause running for approximately 12 hours and 42 minutes from block 26190429. As of publication, the protocol has not released a post-mortem explaining the attack vector.

Market Impact

RUNE, the protocol's native token, dropped approximately 13%, falling from $0.58 to $0.50. The token had been trading steadily before news of the exploit spread on-chain and across social platforms.

A Recurring Pattern

The breach, which surfaced in the early hours of Friday, is at least the third security incident for the protocol in recent years. The incident also renews scrutiny over THORChain's role in the broader DeFi security landscape. Cross-chain bridges and liquidity protocols have historically been the most exploited category in DeFi, with the sector suffering more than $2.8 billion in thefts since 2021.

THORChain has also faced ongoing criticism for its use as a fund-movement channel by bad actors. High-profile exploit proceeds routed through the protocol have included funds linked to the FTX exploiter ($124 million), the Bybit hacker ($1.2 billion+), and the Balancer exploiter ($120 million).

Context

THORChain operates as a decentralized cross-chain liquidity network, letting users swap native assets across different blockchains without wrapping or bridging through a centralized intermediary. That architectural openness — while a core feature — has repeatedly made it a target. The protocol has yet to issue a public statement, and the investigation by ZachXBT and PeckShield is ongoing. (***)