THORChain Suffers $10M Multi-Chain Exploit, RUNE Plunges 15% as Trading Halts

THORChain has reportedly fallen victim to a sophisticated multi-chain exploit affecting Bitcoin, Ethereum, BSC, and Base networks, according to prominent blockchain investigator ZachXBT. The attack has resulted in estimated losses exceeding $10 million, prompting the protocol to implement emergency safeguards.

Exploit Details and Loss Estimates

ZachXBT initially flagged the security breach on social media, warning the crypto community about suspicious activity across multiple blockchain networks connected to THORChain's cross-chain infrastructure. While early estimates placed the stolen funds at approximately $7.4 million, the investigator later revised his assessment upward to at least $10 million after conducting a more thorough on-chain analysis.

The blockchain sleuth also criticized third-party accounts that disseminated the exploit alert without conducting independent verification. "Can tell because they did not check the numbers themselves / chains listed," ZachXBT wrote, emphasizing the importance of proper sourcing and direct on-chain tracking before publishing loss estimates. His statement indicated that the full scope of the breach still required comprehensive confirmation through blockchain forensics.

Emergency Protocol Activation

In response to the exploit reports, THORChain's node operators executed a global emergency halt across the decentralized exchange network. This decisive action paused all trading activity while security teams investigated the breach and examined potentially compromised routing paths.

According to THORChain's official security documentation, the HaltTrading function represents an emergency control mechanism that stops both trading operations and observations across all connected blockchains. Notably, the THORChain blockchain itself and native RUNE transactions can continue operating during such halts, which are designed to be activated by node operators during critical security incidents.

Market Impact on RUNE Token

The native RUNE token experienced immediate and severe market reaction following the exploit disclosure. Within minutes of ZachXBT's public alert, RUNE's price plummeted approximately 15%, falling from above $0.58 to nearly $0.50. At the time of reporting, the token had partially recovered to $0.58, with 24-hour trading volume reaching $32.46 million and a market capitalization of approximately $204.88 million.

Despite the short-term price recovery, RUNE remains down more than 70% over the one-year period, reflecting broader challenges facing the cross-chain protocol.

THORChain's Exploit History

This incident marks the latest security concern for THORChain, which has previously been implicated in fund movements related to major decentralized finance attacks. In April, the protocol was identified as a routing mechanism for assets stolen in the $290 million Kelp DAO exploit, where attackers laundered approximately $175 million in ETH through THORChain and Umbra before dispersing funds across multiple wallets.

That earlier incident highlighted the complexities of asset recovery in cross-chain environments, where stolen funds can quickly traverse multiple blockchain networks, making tracking and potential freezing significantly more challenging for affected protocols and law enforcement.

Broader Industry Implications

The THORChain exploit underscores ongoing security vulnerabilities in cross-chain bridge technology and decentralized exchange infrastructure. ZachXBT has recently been vocal about response protocols during major hacks, including his criticism of Circle's handling of funds connected to the $285 million Drift Protocol attack, contributing to wider industry discussions about the appropriate speed and coordination required when addressing large-scale crypto exploits.

Coinasity's Take

The THORChain incident reinforces the persistent security challenges facing cross-chain protocols in DeFi. With over $10 million allegedly stolen across four major blockchain networks, this exploit demonstrates that multi-chain infrastructure remains a prime target for sophisticated attackers. The protocol's swift emergency halt shows appropriate crisis response, but THORChain's recurring appearance in major exploit fund flows raises questions about inherent architectural vulnerabilities in permissionless cross-chain systems. As the industry matures, protocols must balance decentralization ideals with enhanced security monitoring and circuit-breaker mechanisms to protect user funds.