THORChain Launches Recovery Portal After $10 Million Exploit
THORChain launched a recovery portal on May 17 for 12,847 wallets affected by a $10 million exploit, setting a June 4 deadline for treasury-backed refund submissions. The exploit, the largest to hit THORChain in its operating history, drained funds from the protocol’s liquidity pools through a vulnerability that the team has not fully disclosed publicly.
The recovery mechanism is funded directly by the THORChain treasury rather than by an external insurer or third-party guarantor.
How the Recovery Portal Works
Users who held funds in THORChain’s affected pools at the time of the exploit can submit wallet verification through the recovery portal before June 4. The portal matches submitted wallet addresses against a snapshot of the protocol’s state taken immediately before the exploit.
Verified addresses receive refunds denominated in the assets they lost, drawn from treasury reserves.
RUNE (RUNE), THORChain’s native token, functions both as the settlement asset for cross-chain swaps and as the bonding collateral that node operators must post to participate in the network. The treasury reserves backing the refund pool are partially denominated in RUNE.
The team said the portal’s success depends on participation volume.
If submissions from a high share of affected wallets arrive before the deadline, the refund process proceeds in a single distribution round. If the submission rate is low, the team may extend the window before final settlement.
No extension has been announced.
What THORChain Is
THORChain operates as a decentralized cross-chain exchange, allowing users to swap native assets across different blockchains without wrapping tokens or using a centralized intermediary. A user wanting to exchange native Bitcoin (BTC) for native Ethereum (ETH) can do so directly through THORChain’s liquidity pools without depositing on a centralized exchange.
Cross-chain swaps in this context refer to direct asset transfers between two separate blockchains, such as Bitcoin and Ethereum, using a protocol that holds liquidity on both chains simultaneously.
RUNE acts as the intermediary asset in every swap, creating demand tied to protocol volume.
The protocol launched its mainnet in 2021 and became one of the most-used cross-chain swap venues in decentralized finance over the following three years. It has experienced previous exploits, including two separate incidents in 2021 that together cost approximately $13 million, though those events did not result in structured treasury-backed recovery programs.
Also Read: What Blockchain Oracles Actually Are
Background
THORChain’s 2021 exploits drew significant attention to the security risks of cross-chain liquidity protocols.
In June 2021, an attacker manipulated ETH pool logic to drain approximately $5 million. Weeks later, a second attacker used a similar exploit vector to steal a further $8 million.
The team paused the network after each event, deployed fixes, and resumed operations without a formal refund mechanism for affected users.
The current exploit represents a departure from that precedent. The decision to build a recovery portal with treasury backing and a fixed deadline reflects a more structured approach to incident response.
Whether the treasury holds sufficient reserves to cover all verified submissions at full face value has not been confirmed by the team in public communications reviewed for this article.
RUNE has traded between roughly $1 and $4 over the past 12 months, giving the treasury’s RUNE reserves a value that fluctuates with market conditions. Affected users receiving refunds in RUNE rather than the original swap assets take on that price exposure.
Also Read: Zcash Holds Above $510 as Privacy Coin Draws Renewed Trending Interest
Outlook
The June 4 deadline creates a hard constraint on the recovery timeline.
Users who miss the submission window are unlikely to receive compensation through this mechanism, as treasury-backed programs of this kind typically do not reopen after their stated close dates.
The broader implication for THORChain’s protocol reputation depends on how many affected wallets receive full refunds. A high completion rate would strengthen the case that THORChain can recover from major exploits without permanent capital flight.
A partial recovery, particularly one where smaller wallet holders receive cents on the dollar, would reinforce the risk perception that has historically limited institutional adoption of cross-chain liquidity protocols.
Read Next: Aerodrome Finance Slides 6% as Base Chain DEX Posts $16 Million in Daily Volume
