THORChain Exploit Fears Trigger 14% RUNE Drop as Investigators Track Over $10M in Suspected Stolen Crypto

Suspected THORChain hack sparks multi-chain theft concerns

THORChain, a cross-chain cryptocurrency trading protocol, is facing fresh scrutiny after a suspected exploit that may have resulted in more than $10 million in stolen digital assets. The incident involves activity spanning multiple networks, including Bitcoin, Ethereum, BNB Chain, and Base, according to on-chain investigators and blockchain security firms.

The reported breach quickly reverberated through decentralized finance markets, with RUNE—THORChain’s native token—sliding by nearly 14% in the aftermath as traders reacted to uncertainty over the scope of the incident.

ZachXBT identifies suspicious router-linked activity

Early alerts came from prominent on-chain investigator ZachXBT, who pointed to suspicious behavior tied to THORChain’s router infrastructure. ZachXBT said attackers moved approximately $7.2 million in assets, including USDT, USDC, and wrapped Bitcoin, across several blockchain networks before swapping into ETH.

The funds were reported to have been distributed across Bitcoin, Ethereum, BNB Chain, and Base. Initial estimates placed losses above $7.4 million, but ZachXBT later revised the assessment, stating the total amount potentially stolen may now exceed $10 million.

PeckShield corroborates exploit and lists BTC and multi-chain losses

Blockchain security firm PeckShield also confirmed signs consistent with an exploit. The firm estimated that attackers took about 36.75 BTC—valued at roughly $3 million—along with an additional $7 million in assets drawn from the Ethereum, BNB Chain, and Base ecosystems.

Combined, the figures cited by ZachXBT and PeckShield indicate a suspected theft surpassing $10 million across multiple chains, with stablecoins and bridged assets among the reported targets.

Arkham labels “THORChain Exploiter” wallets and tracks holdings

As the event unfolded, Arkham Intelligence began monitoring wallets connected to the suspicious flows and tagged certain addresses as “THORChain Exploiter”. Arkham’s data showed one Bitcoin-linked wallet holding nearly 36.85 BTC—about $3 million—while an Ethereum-linked wallet held roughly 216 ETH.

According to Arkham’s tracking, most of the suspected stolen assets remained parked in wallets associated with the addresses bc1ql4…f6f37 and 0xd4…890Bd at the time of reporting.

RUNE falls about 14% as markets react

The market response was swift. After reports of the suspected exploit spread, RUNE dropped about 14% within hours, sliding toward the $0.50 level as traders moved to reduce risk exposure.

THORChain has previously faced exploits and used treasury reserves and recovery measures to address earlier incidents. However, in this case, the absence of immediate official communication was cited as contributing to increased uncertainty about the size and impact of the latest breach.

Publication and disclosure notes

This report was published on May 15, 2026 at 10:36 UTC. CoinPedia stated it has provided cryptocurrency and blockchain coverage since 2017, and noted that its content is produced under editorial guidelines based on E-E-A-T principles, with fact-checking against reputable sources.

The publisher also included an investment disclaimer stating that opinions and insights reflect the author’s views on market conditions and that readers should conduct their own research before making investment decisions. Additional disclosures noted that sponsored content and affiliate links may appear on the site, with advertisements marked clearly and editorial content maintained independently from advertising partners.