Key Highlights
- On-chain investigator ZachXBT uncovered a multi-chain attack on THORChain exceeding $10 million across Bitcoin, Ethereum, BSC, and Base networks
- The protocol immediately activated emergency shutdown procedures, freezing all swaps and trading to safeguard liquidity providers
- Compromised addresses contain 36.85 BTC, 3,443 ETH, 96.6 BNB, plus various stablecoins and wrapped assets
- RUNE price plummeted 15%, sliding from $0.58 down to approximately $0.50
- Derivative market activity surged with futures open interest jumping 19% within a four-hour window despite spot price decline
On May 15, 2026, THORChain—a decentralized protocol enabling cross-chain liquidity—became the target of a significant security breach exceeding $10 million in value. The incident was first brought to public attention by prominent blockchain sleuth ZachXBT, who documented suspicious fund movements across multiple blockchain networks.
The breach impacted four separate networks: Bitcoin, Ethereum, BNB Smart Chain, and Base. Malicious actors exploited THORChain’s router smart contracts deployed on each of these chains to siphon funds.
Blockchain analytics firm Arkham traced the stolen assets to specific wallet addresses controlled by the attacker. These addresses currently contain 36.85 BTC, 3,443 ETH, and 96.6 BNB, alongside holdings in USDT, USDC, and wrapped Bitcoin.
ZachXBT’s preliminary assessment placed the damage above $7.4 million. Following deeper blockchain analysis and transaction verification, he revised the estimated loss upward to at least $10 million.
Protocol Activates Emergency Shutdown Protocol
Upon discovering the security breach, THORChain immediately deployed its pre-programmed emergency response system. The HaltTrading function was engaged, effectively freezing all trading and swap functionality across every integrated blockchain.
This emergency measure allows the THORChain blockchain infrastructure and native RUNE token transfers to continue operating normally. The pause mechanism serves to prevent additional exploitation while network validators investigate the incident’s scope and origin.
Cybersecurity monitoring services like PeckShieldAlert quickly identified and flagged the attacker’s wallet addresses following the initial disclosure. Node operators across the network automatically suspended trading operations through the protocol’s automated defense mechanisms.
ZachXBT also publicly criticized a third-party account that republished the exploit information without conducting independent verification. He noted they failed to validate the loss estimates or confirm which blockchain networks were actually compromised.
Token Value Experiences Sharp Decline
RUNE experienced a dramatic 15% value drop within minutes as news of the exploit circulated throughout crypto communities. The token’s price tumbled from over $0.58 down to approximately $0.50 before finding temporary support.
Current market data shows RUNE trading around $0.52 at press time. The token’s 24-hour price range extended from a low of $0.502 to a high of $0.597.
Spot market trading volume exploded by nearly 140% over the previous 24 hours as panicked holders liquidated positions. Interestingly, derivatives markets displayed contrasting behavior.
According to CoinGlass analytics, THORChain futures open interest climbed over 6% to reach $24.80 million in just 60 minutes. Total RUNE futures open interest expanded by 19% across a four-hour period, with major exchanges Binance and Bybit recording increases of approximately 17% and 19% respectively.
RUNE’s total market capitalization hovered near $204.88 million before comprehensive price tracking platforms reflected the complete drawdown. The asset has declined more than 70% on a yearly basis.
This incident marks the second time THORChain has faced security-related scrutiny in 2026. During April, approximately $175 million in ETH from the massive $290 million Kelp DAO breach was laundered through THORChain’s infrastructure as hackers distributed funds across fresh wallet addresses.
The previous incident sparked concerns regarding asset recovery in cross-chain environments, where stolen cryptocurrency becomes increasingly difficult to monitor when distributed across multiple blockchain networks.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
