THORChain Halts All Trading After $10.8 Million Cross-Chain Exploit
THORChain paused all trading and signing on Friday, May 15, after an attacker drained roughly $10.8 million across four networks. The attack hit Bitcoin (BTC), Ethereum (ETH), Binance Smart Chain, and Base.
RUNE, THORChain’s native token, fell 12% in the hour after the exploit was reported. The pause puts the protocol’s entire cross-chain liquidity pool offline until a security review is complete.
What the THORChain Exploit Involved
On-chain investigator ZachXBT was the first to flag the suspicious outflows Friday morning.
The attacker moved approximately $7.2 million in Tether (USDT) across the four chains before the protocol’s node operators voted to suspend operations. THORChain’s team confirmed the halt in a post on the protocol’s official channels, saying the signing process for all chains was disabled as a precautionary step.
The CoinDesk report published Friday put the total drained at $10.8 million.
The full attack vector has not been disclosed by the team.
Also Read: Firo Falls 12% as Privacy Coin Demand Stays Uneven Across the Sector
What THORChain Is
THORChain is a decentralized liquidity protocol that allows users to swap assets across separate blockchains, including Bitcoin and Ethereum, without using wrapped tokens or centralized bridges. It uses liquidity pools funded by external depositors, who earn yield on the assets they contribute.
The protocol’s native token, RUNE (RUNE), serves as the settlement layer for all cross-chain swaps, meaning every pool pairs a deposited asset against RUNE. When the protocol halts, no swaps or withdrawals can be processed.
The architecture makes THORChain one of the few venues where a Bitcoin holder can swap directly into Ethereum without touching a centralized exchange or a custodial bridge.
That same architecture concentrates counterparty risk into the RUNE token and the shared pool structure.
Also Read: LQWD Technologies Updates Lightning Network Growth and Pivot to Agentic Payments
What Comes Next
THORChain has suffered security incidents before. A 2021 attack drained roughly $8 million from its pools, and the protocol resumed operations after a multi-week patch cycle.
Friday’s halt could follow a similar timeline if the team identifies and closes the vulnerability before community governance votes to re-enable signing.
Liquidity providers with assets deposited in THORChain pools cannot withdraw funds while the halt is active. RUNE’s market cap stood at approximately $185 million before Friday’s attack, and the 12% price fall erased roughly $22 million in notional value.
The team has not given a timeline for resumption.
Read Next: Aerodrome Finance Rises as Base Network Activity Lifts the Leading Decentralized Exchange
