TL;DR

  • THORChain, a major decentralized cross-chain exchange, halted all trading Friday after a suspected $10.8 million exploit spanning Bitcoin, Ethereum, BNB Smart Chain, and Base.
  • Blockchain security researchers ZachXBT and security firm PeckShield flagged two theft addresses linked to the attack, prompting THORChain's immediate defensive shutdown.
  • RUNE, THORChain's native token, fell roughly 10-12% on the day to trade near $0.52, per CoinGecko data.
  • The exploit occurred while THORChain was processing approximately $394 million in 24-hour volume, underscoring the scale of liquidity at risk.

What Happened

On Friday morning, blockchain security researcher ZachXBT and security firm PeckShield flagged unusual fund movements routed through THORChain across multiple blockchain networks. The researchers identified two suspected theft addresses -- one on the Bitcoin network and a second on EVM-compatible chains including Ethereum, BNB Smart Chain, and Base -- tied to estimated losses of roughly $10 to $10.8 million.

THORChain responded by pausing all trading and signing operations immediately, a defensive shutdown intended to limit further exposure while the team investigates. As of Friday evening, the protocol had not released technical details about the specific vulnerability or officially confirmed the researchers' loss figures. The halt itself signals the team is treating the situation as a genuine security event.

THORChain is a decentralized liquidity protocol that allows users to swap assets directly between blockchains without relying on a centralized exchange or custodian. It acts as an on-chain bridge layer across networks including Bitcoin, Ethereum, Avalanche, and several others. At the time of the suspected exploit, the protocol was handling roughly $394 million in 24-hour swap volume -- making it a significant and lucrative target.

The attack appears to have leveraged THORChain's cross-chain routing mechanism itself, moving funds across Bitcoin, Ethereum, BNB Chain, and Base in a coordinated pattern designed to obscure the trail. This type of multi-chain movement is significantly harder to trace and recover than single-chain thefts.

Why RUNE Fell on the THORChain Exploit News

RUNE is the native settlement asset of the THORChain network. Every cross-chain swap that passes through THORChain routes through RUNE as a counterparty asset in the liquidity pools. A trading halt stops fee accrual, freezes LP withdrawals, and creates acute uncertainty about the protocol's financial health and operational continuity.

The combination of potential fund losses, an unknown attack vector, and a defensive shutdown drove RUNE down roughly 10% to around $0.52, with some sources estimating a 12% intraday decline. Cross-chain protocols that have suffered exploits historically face severe confidence crises even when actual losses are contained, because traders reprice the tail risk of further or deeper vulnerabilities. RUNE's price action on Friday reflects that dynamic.

The broader crypto market was already under pressure on Friday. Bitcoin pulled back from the $82,000 level as macro headwinds from rising Treasury yields, the Trump-Xi summit disappointment, and surging oil prices weighed on risk appetite. See our earlier coverage: CLARITY Act Clears Senate Panel, But Bitcoin Fades Below $80K as Warsh Era Begins. A DeFi-specific exploit in that environment amplifies selling pressure on RUNE further.

Implications for Crypto Traders

DeFi liquidity providers: Any LP with assets currently deposited in THORChain pools faces uncertain access until trading resumes and the investigation concludes. LPs should monitor THORChain's official Telegram and Discord channels closely for updates on whether funds are at risk or recoverable.

RUNE holders: With the protocol halted, RUNE's price is being set on centralized exchanges (Binance, Bybit, and others). Volatility is likely to remain elevated until the team either confirms the scope of losses and a fix, or resumes trading with a credible post-mortem.

Broader DeFi and DEX sentiment: Cross-chain bridges and multi-chain liquidity protocols remain the most consistently targeted infrastructure in crypto. This incident reinforces the risk premium attached to decentralized exchange tokens and could weigh on sentiment for peers in the cross-chain DeFi sector in the near term.

Context: macro stress compounding protocol risk. Today's broader market conditions -- stocks down 1.2%+, yields at year highs, oil above $109 -- create an environment where investors are already de-risking. A DeFi exploit layered on top of that macro backdrop reduces the cushion for any RUNE recovery bounce. For more on the macro picture, see: Treasury Yields Hit Year Highs, Stocks Tumble as Inflation Shock Rattles Markets.

Potential Positives vs Negatives

Positives:

  • THORChain's rapid defensive halt reflects a functioning incident-response process, which may limit total damage compared to protocols that react slowly or deny an exploit is occurring.
  • If confirmed losses are at the $10-11 million range, the protocol's historically deep liquidity could support a recovery once trading resumes with a credible fix in place.
  • Independent security researchers (ZachXBT, PeckShield) identified the suspected exploit quickly, reducing the window for further theft during the active attack phase.

Negatives:

  • THORChain already suspended its ThorFi lending operations in January 2025 amid insolvency concerns tied to $200 million in defaulted obligations. A second major security incident within roughly 18 months raises serious questions about the protocol's long-term risk profile.
  • The attack exploited THORChain's multi-chain routing capability rather than a single-chain smart contract flaw, meaning the underlying attack surface may be structurally difficult to patch without significant protocol changes.
  • A prolonged trading halt erodes LP confidence and daily volume, reducing RUNE's fee-based utility value and creating sustained sell pressure from LPs looking to exit when withdrawals reopen.

What Could Happen From Here

Base case: THORChain completes its internal investigation within 24-48 hours, publishes a post-mortem with confirmed losses and a specific vulnerability description, and gradually resumes trading with a patch in place. RUNE stabilizes in the $0.45-$0.55 range pending a trading restart. Liquidity providers return cautiously over several days. Confirmed by: official trading resume announcement plus a credible technical post-mortem; invalidated by further exploits after partial restart or continued silence from the team.

Upside case: Losses are confirmed below $5 million, the team identifies and patches the vulnerability quickly, and the market reads the swift defensive response as evidence of strong protocol governance. RUNE reclaims pre-halt levels (above $0.58) within 48-72 hours. Confirmed by: exploit total confirmed lower than initial estimates, trading resuming within 12-24 hours, and a credible audited fix; invalidated by LP outflows accelerating upon resumption.

Downside case: The attack vector proves to be a deeper flaw in THORChain's cross-chain settlement architecture. Confirmed losses exceed $15 million, LPs rush to exit when trading resumes, and RUNE tests lower support levels in the $0.30-$0.40 range. Could trigger a broader DeFi sector sell-off if similar protocols are flagged as using comparable mechanisms. Confirmed by: ongoing or resumed exploits after partial restart, large-scale LP outflows on-chain, or an announcement of further operational suspension; invalidated by a clean technical audit and orderly LP re-entry.

What to Watch Next (Next 24h)

  • THORChain official channels: Any post-mortem, confirmed loss figure, or trading-resume announcement is the primary market-moving catalyst for RUNE price in the next 24 hours.
  • Total confirmed losses: ZachXBT's initial estimate of $7.4 million has been revised upward toward $10.8 million by Decrypt and CoinDesk. The final confirmed figure sets the severity baseline and shapes LP confidence.
  • LP outflows on-chain: Monitor on-chain data for large liquidity withdrawals from THORChain pools when trading resumes. Significant outflows signal that LPs are treating this as a structural risk rather than a manageable incident.
  • RUNE price on CEXs: Price action on Binance and other major centralized exchanges provides the real-time market verdict on recovery probability.
  • Contagion risk to peer protocols: Watch for security flags raised against other cross-chain bridge protocols or THORChain-adjacent projects (such as Maya Protocol or cross-chain aggregators) in the next 24 hours.

FAQ

Q: Are funds stuck on THORChain right now?
A: With trading and signing paused, active swaps are halted and normal LP withdrawals are suspended. Funds already deposited as liquidity remain on-chain but cannot be accessed through the normal protocol interface until operations resume. Monitor THORChain's official Telegram channel and Discord for updates.

Q: Was THORChain directly hacked, or was it used as a laundering tool?
A: Based on initial reports from ZachXBT and PeckShield, this appears to be a direct exploit of THORChain's liquidity pools rather than a laundering-only incident. However, the team has not yet confirmed the exact attack vector, and the investigation is ongoing. This distinction matters for assessing whether LP funds were directly at risk.

Understanding how to react to security incidents and manage risk around DeFi positions is a skill that separates disciplined traders from reactive ones. ChartDojo's AI-powered feedback helps you build that judgment on real market scenarios -- so when events like this unfold, you have a framework to act on rather than a gut feeling. Build real skills, not bad habits. Start your free trial today.

Sources

Header image source: pexels by Marnie Griffiths. License: PEXELS.