ZachXBT

Arkham

THORChain

Tornado

Decentralized liquidity protocol THORChain halted trading after blockchain investigator ZachXBT flagged a suspected exploit of more than $10 million.
A THORChain alerts Telegram channel <a href="https://t.me/thorchain_alert/44623" rel="noopener noreferrer nofollow">showed</a> all trading and signing halted, with a global node pause extended until block 26191149, or roughly 12 hours and 42 minutes. The halt came shortly after ZachXBT <a href="https://t.me/investigations/319" rel="noopener noreferrer nofollow">said</a> the protocol had likely been exploited across Bitcoin, Ethereum, BNB Chain and Base.
A <a href="https://intel.arkm.com/explorer/entity/f3f93908-ec6d-4f1f-991c-ffda04155878" rel="noopener noreferrer nofollow">wallet</a> labeled by Arkham as the THORChain exploiter showed $10.8 million in holdings, transferred across several smaller transactions in the 30 minutes before 10:11 am UTC.
The suspected exploit adds to the mounting security concerns around decentralized finance (DeFi) protocols, after hackers stole over $634 million during April, marking the highest monthly sum since the $1.46 billion in February 2025, when hackers staged the record $1.4 billion hack on Bybit exchange, DefiLlama <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">data</a> shows.
Cointelegraph reached out to THORChain for comment. The protocol had not publicly confirmed the exploit at the time of publication, though ZachXBT and <a href="https://x.com/PeckShieldAlert/status/2055226411125027171" rel="noopener noreferrer nofollow">PeckShield</a> flagged suspicious activity, and THORChain alerts showed trading and signing had been halted.
<img alt="THORChain pauses trading after suspected $10M exploit" height="556" src="https://s3-images.ctmedia.io/media/content/pasted-image-666.png" width="1897">
Thorchain exploiter-tagged wallet. Source: Arkham
<h2 id="rune-price-falls-13-after-suspected-exploit">RUNE price falls 13% after suspected exploit&nbsp;</h2>
THORChain’s RUNE token fell by around 13% following the suspected exploit and traded near $0.51 at the time of writing, <a href="https://www.coingecko.com/en/coins/thorchain?chart=type%3Dmarket_cap%26mode%3Dline%26timeframe%3Dh24" rel="noopener noreferrer nofollow">according</a> to CoinGecko data.
<img alt="THORChain pauses trading after suspected $10M exploit" height="1158" src="https://s3-images.ctmedia.io/media/content/pasted-image-672.png" width="2048">
RUNE/USD, one-day chart. Source: CoinGecko
The latest correction adds additional pressure to the token’s price action, which is down 72% during the past year.
Related: <a href="https://cointelegraph.com/news/kelp-dao-exploit-prompts-defi-protocols-rethink-oracle-providers" rel="noopener noreferrer nofollow">Kelp DAO exploit prompts DeFi protocols to rethink oracle providers</a>
As a non-custodial cross-chain protocol, THORChain has repeatedly been used by malicious actors to swap stolen funds, though it is not a cryptocurrency mixer like Tornado Cash.
Earlier in April, the attacker behind the $293 million Kelp DAO <a href="https://cointelegraph.com/news/kelp-dao-hacker-launders-nearly-all-75700-eth-through-thorchain" rel="noopener noreferrer nofollow">exploit swapped 75,700 Ether (ETH) through THORChain</a>, generating about $910,000 in revenue for the protocol.
The majority of the $1.4 billion stolen during the Bybit hack, or about $1.2 billion, was also moved through THORChain by hackers, who swapped it from Ether to Bitcoin, <a href="https://x.com/benbybit/status/1914155633781469371" rel="noopener noreferrer nofollow">according</a> to Bybit co-founder and CEO Ben Zhou.

THORChain pauses trading after suspected $10M exploit

Table of Contents

Cointelegraph

Other articles published on May 15, 2026

Join our free newsletter for daily crypto updates!