Ethereum

ZachXBT

Million

Arkham

Drops

<ul>
 <li>Thorchain paused trading earlier today after attackers drained $10.7 million in Bitcoin, Ethereum and BNB.</li>
 <li>The attack was first reported by ZachXBT and involved the breach of the vault withdrawal process.</li>
</ul>
Controversial cross-chain liquidity protocol Thorchain has become the latest victim of a cyberattack, losing over $10 million in an attack earlier today.
The attack was detected quickly, with the protocol pausing all activity, including trading and signing. A global pause on all nodes was activated and is set to last nearly 13 hours, or up until block 26,191,149.
<blockquote class="twitter-tweet">
 <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a><a href="https://twitter.com/THORChain?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@THORChain</a> has been exploited for ~$10M worth of crypto, including 36.75 <a href="https://twitter.com/search?q=%24BTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$BTC</a> ($3M) and ~$7M worth of assets from <a href="https://twitter.com/hashtag/BNBChain?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#BNBChain</a>, <a href="https://twitter.com/hashtag/Ethereum?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Ethereum</a>, and <a href="https://twitter.com/hashtag/Base?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Base</a>.
 The stolen funds mainly sit in: bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37… <a href="https://t.co/mhWIWueVPK" rel="noopener noreferrer nofollow">pic.twitter.com/mhWIWueVPK</a>
 — PeckShield <a href="https://twitter.com/PeckShieldAlert/status/2055226411125027171?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 15, 2026</a>
</blockquote>
Data from Arkham Intelligence shows that the attacker’s address holds 36.8 BTC, valued at $2.96 million at current prices. He also holds 3,191 ETH, valued at $7.2 million, and a small amount of THOR, XRUNE and DAI. While the BTC was transferred in one large transaction, the other tokens were transferred in dozens of smaller transactions.
<figure class="wp-caption alignnone"><img src="https://ethnews.com/wp-content/uploads/2026/05/Screenshot-2026-05-15-at-16.04.55.png" alt="thorchain" width="1496" height="948">
 <figcaption>
 Source: <a href="https://intel.arkm.com/explorer/entity/f3f93908-ec6d-4f1f-991c-ffda04155878" rel="noopener noreferrer nofollow">Arkham</a>
 </figcaption>
</figure>
Thorchain has yet to make any statement on the exploit. The network’s RUNE token took a big hit immediately after the attack was made public, dipping 14% from $0.585 to $0.501 in two hours. It trades at $0.514 at press time.
<h2 id="strong-attacker-targeted-thorchain-s-vault-transfers-strong">Attacker Targeted Thorchain’s Vault Transfers</h2>
Thorchain is a decentralized network that lets users swap crypto directly across multiple blockchains without relying on centralized platforms. It’s non-custodial and relies on liquidity pools to facilitate the swaps. Essentially, validators on the network observe deposits from the users and then, together, approve withdrawals from shared vaults.
According to security firm Blockaid, it was this process that the attackers targeted to breach the protocol. The attacker reportedly intercepted inbound deposit observations and modified them into fake outbound payment requests. This allowed him to replace legitimate information with fake instructions to withdraw funds from the vaults and send them to his address. This allowed them to drain funds across Ethereum, Bitcoin and BNB.
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨"> UPDATE — <a href="https://twitter.com/THORChain?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@THORChain</a> exploit (~$10M+)
 Blockaid's analysis identifies the suspected root cause: a proposer-forgery bug in THORChain's Bifrost Attestation Gossip. Validator signatures didn't cover the inbound/outbound bit, letting a proposer flip a real inbound observation into…
 — Blockaid (@blockaid_) <a href="https://twitter.com/blockaid_/status/2055266169125286187?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 15, 2026</a>
</blockquote>
Most notably, Blockaid says Thorchain developers had already developed a fix for this specific vulnerability, which would have thwarted the attack. The fix was meant to be implemented earlier this month, but the automated system that tests and distributes software updates on Thorchain reportedly failed.
It’s not the first time Thorchain has been attacked. Previous attacks saw nearly $15 million stolen, with two attacks in July 2021 happening just days apart. Today’s attack comes just weeks after KelpDAO and Drift Protocol got hit for over $550 million combined. Kelp lost the funds to a breach on its LayerZero bridge infrastructure, as we <a href="https://ethnews.com/after-kelpdao-debacle-700-million-solv-protocol-ditches-layerzero-for-chainlink/" rel="noopener noreferrer nofollow">reported</a>. Ironically, Thorchain was built for users who do not want to use bridges as they are prone to attacks.
The protocol has a controversial reputation. Being non-custodial, it allows users to make swaps virtually unchecked. This has made it a destination for criminals. In the KelpDAO attack, the hacker used Thorchain to launder 75,700 ETH, worth $175 million at the time. Thorchain generated nearly $1 million in fees from that hacker.
<figure class="wp-caption alignnone"><img src="https://ethnews.com/wp-content/uploads/2026/05/thorchain-scaled.jpeg" alt="thorchain" width="2560" height="1145">
 <figcaption>
 Source: <a href="https://x.com/EmberCN/status/2047116852900565221" rel="noopener noreferrer nofollow">Ember CN</a> on X.
 </figcaption>
</figure>
The largest hack in crypto history, Bybit’s $1.4 billion exploit, also has links to Thorchain. <a href="https://x.com/benbybit/status/1914155633781469371" rel="noopener noreferrer nofollow">According</a> to Bybit CEO Ben Zhou, at least $1.2 billion of the stolen funds were laundered through Thorchain.
The post <a href="https://ethnews.com/thorchain-hacked-for-10-7-million-as-rune-drops-14/" rel="noopener noreferrer nofollow">Thorchain Hacked for $10.7 Million as RUNE Drops 14%</a> appeared first on <a href="https://ethnews.com" rel="noopener noreferrer nofollow">ETHNews</a>.

Thorchain Hacked for $10.7 Million as RUNE Drops 14%

Table of Contents

ETHNews

Other articles published on May 15, 2026

Join our free newsletter for daily crypto updates!