THORChain halts trading after suspected $10M exploit

THORChain suspended trading on Friday after researchers flagged a suspected exploit that moved more than $10 million across Bitcoin, Ethereum, BNB Smart Chain and Base. The protocol paused operations while investigators examine on-chain activity.

Blockchain researcher ZachXBT and security firm PeckShield traced the suspected breach to two addresses: one on Bitcoin and one on EVM-compatible chains including Ethereum, BNB Smart Chain and Base. Their analysis prompted the protocol to halt trading Friday morning while teams review transaction flows.

Tracing indicates the activity occurred during a period when THORChain was processing roughly $394 million in daily volume. Investigators say attackers appeared to use the protocol’s cross-chain routing to move funds tied to the KelpDAO breach between Ethereum and Bitcoin, then consolidate assets through the two identified addresses.

Market data showed THORChain’s native token, RUNE, fell about 10% to near $0.52 on the day. THORChain has not published technical details about the suspected vulnerability or confirmed the researchers’ loss estimates.

In January 2025 the protocol suspended ThorFi lending operations amid insolvency allegations and began a 90-day restructuring to address about $200 million in defaulted obligations. In September attackers drained $1.2 million from the founder’s personal wallet; a blockchain researcher later linked that incident to North Korean-linked actors.

Cross-chain bridges and liquidity routers have been frequent targets this year. Platforms and services have reported losses, including a $6.7 million theft from TrustedVolumes earlier this month. Security firm CertiK reports North Korean-linked hackers accounted for about $2.1 billion in cryptocurrency thefts during 2025, roughly 60% of losses the firm tracked.

THORChain has not given a timetable for resuming trading or released a postmortem. Users and liquidity providers are monitoring on-chain evidence and official updates from the protocol’s engineering and security teams.