Asgard

Space

ZachXBT

THORChain

THORChain<a href="https://yellow.com/asset/rune" rel="noopener noreferrer nofollow">(RUNE)</a> halted trading and signing on Friday after <a href="https://yellow.com/news/thorchain-exploit-108m-rune-drops" rel="noopener noreferrer nofollow">attackers drained roughly $10.8 million</a> from one of its Asgard vaults, with Ledger's CTO flagging possible MPC weaknesses.
<h2 id="asgard-vault-drained-across-four-chains">Asgard Vault Drained Across Four Chains</h2>
The cross-chain liquidity protocol <a href="https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12" rel="noopener noreferrer nofollow">paused</a> trading and signing operations after on-chain investigator ZachXBT flagged suspicious outflows targeting vaults on Bitcoin<a href="https://yellow.com/asset/btc" rel="noopener noreferrer nofollow">(BTC)</a>, Ethereum<a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a>, BNB Chain, and Base.
In a statement, THORChain said the network automatically detected abnormal activity and suspended signing to block further outbound transfers.
<blockquote>
 One of six Asgard vaults appeared compromised, churn was paused, and node operators were asked to review key management and operational security.
</blockquote>
The protocol's Mimir governance module flipped trading and signing halts to active, with the pause <a href="https://ambcrypto.com/thorchain-exploit-hits-bitcoin-ethereum-and-bsc-hackers-steal-over-10-mln/" rel="noopener noreferrer nofollow">running</a> for roughly 12 hours from block 26190429.
Wallets tied to the attacker hold about 3,443 ETH, 36.85 BTC, and 96.6 BNB, alongside USDT, USDC, WBTC, AAVE, and LINK. RUNE fell about 12% on the news, dropping toward $0.50. THORChain said initial indications suggest user funds were not directly affected.
Also Read:<a href="https://yellow.com/news/gemini-space-station-securities-fraud-claims-ipo" rel="noopener noreferrer nofollow">Gemini Space Station Hit By Multiple Securities Fraud Claims After IPO</a>
<h2 id="ledger-cto-flags-mpc-risk">Ledger CTO Flags MPC Risk</h2>
Charles Guillemet, chief technology officer at hardware wallet maker Ledger, suggested the incident could involve weaknesses in threshold signature scheme infrastructure.
Citing remarks from THORChain contributor JP Thor, Guillemet <a href="https://coingape.com/thorchain-suffers-10m-exploit-across-bitcoin-ethereum-bsc-base-chains/" rel="noopener noreferrer nofollow">said</a> the breach could be an MPC exploit involving GG20, a threshold signature protocol used in some multi-party computation wallet systems.
He noted that earlier GG18 and GG20 protocols have faced critical vulnerabilities, including CVE-2023-33241 and TSSHOCK.
<blockquote>
 Guillemet warned that advances in AI-assisted vulnerability discovery may be lowering the bar for compromising validator infrastructure once thought hard to attack.
</blockquote>
A theoretical attack path, he said, could involve compromising a validator, waiting for it to join an active vault, exploiting malformed proofs during signing, and reconstructing vault keys offline. He cautioned that the root cause remains unclear, and investigators have not confirmed whether a known GG20 flaw or a new weakness was involved.
<h2 id="thorchain-s-recent-security-record">THORChain's Recent Security Record</h2>
THORChain's vaults rely on TSS, a cryptographic system that lets multiple nodes jointly produce signatures without rebuilding the full private key in one place. The architecture has long been viewed as a strength of cross-chain DeFi, yet it has now drawn fresh scrutiny.
The protocol has weathered several high-profile incidents over the past year. In Feb. 2025, attackers behind the <a href="https://yellow.com/news/bybit-dollar15b-hack-explained-how-hackers-accessed-cold-wallets-is-ethereum-compromised" rel="noopener noreferrer nofollow">$1.4 billion Bybit hack</a> routed close to $1.2 billion through THORChain to convert assets into Bitcoin.
The <a href="https://yellow.com/news/kelpdao-exploit-eth-to-bitcoin-thorchain-surge" rel="noopener noreferrer nofollow">KelpDAO exploiter also used the THORChain protocol</a> to move about $80 million in Ether, while THORChain co-founder JP Thorbjornsen lost $1.35 million in a deepfake Zoom scam in Sept. 2025.
Read Next:<a href="https://yellow.com/news/southeast-asia-blockchain-week-bangkok-ripple-avalanche-solana-k-pop" rel="noopener noreferrer nofollow">Southeast Asia Blockchain Week Brings Ripple, Avalanche, Solana Foundation, And K-Pop To Bangkok</a>

Ledger CTO Flags MPC Risk After THORChain's $10.8M Vault Hit

Table of Contents

Yellow News

Other articles published on May 15, 2026

Join our free newsletter for daily crypto updates!