THORChain Halts Trading After Researchers Flag Suspected $10M Multi-Chain Exploit

Trading Paused After Suspected Multi-Chain Attack

THORChain paused trading after blockchain security researchers ZachXBT and PeckShield flagged a suspected exploit affecting multiple networks, including Bitcoin, Ethereum, BNB Smart Chain, and Base. The researchers estimated potential losses at more than $10 million, though they stressed the incident was *suspected* and not yet fully confirmed.

The alerts focused on activity spanning both the Bitcoin network and EVM-compatible chains. According to the researchers, two alleged theft addresses were identified across these environments, suggesting a coordinated incident that may have moved value across several blockchains.

On-Chain Findings and Loss Estimates

Both ZachXBT and PeckShield pointed to the same general conclusion: the behavior observed appeared consistent with an exploit that could have resulted in over $10 million in losses. However, they characterized the event as likely rather than definitively verified at the time of their reports.

The suspected exploit’s cross-chain scope is notable given THORChain’s role as a liquidity protocol facilitating swaps between native assets such as BTC and assets on EVM chains. The incident was reported as spanning Bitcoin, Ethereum, BNB Smart Chain, and Base, highlighting the multi-network footprint of the suspected activity.

Market Reaction Hits RUNE

News of the suspected exploit weighed on the protocol’s native token. RUNE fell by as much as 11%, trading near $0.52 at the time of publication, based on CoinGecko pricing data.

Latest Incident in a Series of Disruptions

The trading pause adds to a broader record of security and operational events tied to the cross-chain liquidity protocol.

In January 2025, THORChain previously suspended its ThorFi lending operations amid insolvency allegations. That suspension was followed by a 90-day restructuring process carried out through validators.

Afterward, the protocol addressed a major balance-sheet issue, resolving a $200 million debt crisis by converting defaulted obligations into a new equity-style token.

Past Exploit Linked to Founder’s Wallet

The ecosystem has also faced incidents involving individuals associated with the project. In September 2025, THORSwap issued a bounty after an exploit of THORChain founder John-Paul Thorbjornsen’s personal wallet that resulted in losses of about $1.2 million. ZachXBT linked that incident to North Korean hackers, according to the prior reporting referenced in the original account.

Use as a Cross-Chain Route in Unrelated Hacks

Beyond direct incidents, the protocol has also been cited as a conduit used in cross-chain laundering connected to external exploits. The article notes that THORChain has appeared repeatedly as a route for moving funds across networks in unrelated cases.

One of the most recent examples cited involved funds from the Kelp DAO hack that were moved from ETH to BTC via THORChain, driving the protocol’s daily volume to $394 million, as previously reported by The Block.

Developing Situation

The incident was described as a developing story, with the exploit characterized by researchers as suspected and not conclusively confirmed at the time the information was shared. THORChain’s decision to pause trading followed the public alerts from ZachXBT and PeckShield regarding the alleged multi-chain activity and estimated losses exceeding $10 million.