THORChain Halts Swaps after $10 Million Multi-Chain Exploit

THORChain suspended trading operations after attackers drained over $10 million across several blockchain networks. The exploit affected Bitcoin, Ethereum, BNB Smart Chain, and Base-linked assets through unauthorised withdrawals. Meanwhile, RUNE dropped sharply as trading activity surged across spot and derivatives markets.

THORChain Activates Emergency Halt After Exploit

THORChain paused all swaps and trading operations after security researchers detected suspicious outflows from protocol-linked wallets. The decentralised liquidity protocol triggered its emergency mechanism to reduce further losses and protect liquidity providers. As a result, network validators halted key services across affected chains.

Blockchain investigator ZachXBT reported losses exceeding $10 million on May 15 through multiple compromised wallets. The exploit targeted THORChain router contracts connected to Bitcoin, Ethereum, BNB Smart Chain, and Base infrastructure. Furthermore, researchers traced stolen assets across several token holdings and blockchain addresses.

Security firms identified wallets containing large amounts of Bitcoin, Ethereum, BNB, USDT, USDC, and wrapped Bitcoin assets. Analytics platforms also linked the wallets to rapid fund movements after the exploit occurred. Consequently, THORChain developers and node operators moved quickly to contain broader liquidity risks.

Multi-Chain Exploits Renew Concerns Around DeFi Infrastructure

The latest exploit renewed concerns surrounding decentralised finance interoperability and cross-chain liquidity protocols. THORChain supports swaps between independent blockchains without centralised exchanges or custodians. However, the architecture increases operational complexity and expands possible attack surfaces.

Cross-chain protocols continue attracting hackers because they manage large liquidity pools across multiple blockchain ecosystems. Attackers often target bridge contracts, router systems, and liquidity mechanisms handling cross-chain asset transfers. Therefore, several protocols increased monitoring systems and emergency controls during the past year.

THORChain already faced security challenges in previous years involving smart contract vulnerabilities and operational disruptions. The latest exploit marked another major setback for the protocol during ongoing market volatility. Meanwhile, developers continued assessing the exact technical cause behind the incident.

The attack also followed another major decentralised finance exploit involving KelpDAO earlier this year. KelpDAO reportedly suffered losses exceeding $290 million through a LayerZero-powered bridge vulnerability. That incident also raised concerns about possible contagion risks affecting connected DeFi protocols.

Protocols linked to cross-chain infrastructure remain vulnerable because attackers exploit communication layers between independent blockchain networks. Additionally, rapid transaction execution often complicates response efforts during active exploits. As a result, several platforms introduced automatic shutdown systems and enhanced wallet monitoring tools.

RUNE Drops Sharply While Derivatives Activity Increases

RUNE recorded steep losses after news of the exploit spread across cryptocurrency trading platforms and blockchain communities. The token dropped nearly 12% within hours and reached an intraday low near $0.502. However, trading activity increased sharply as market participants reacted to the security breach.

At the time of reporting, RUNE traded around $0.520 after fluctuating between $0.502 and $0.597 during the session. Trading volume also surged nearly 140% within 24 hours across major exchanges. Consequently, the token ranked among the session’s most active digital assets.

Derivatives activity increased despite falling prices, according to data from CoinGlass. THORChain futures’ open interest climbed above $24.8 million within a short period after the exploit emerged. Binance and Bybit also recorded strong increases in RUNE-linked futures positions.

The sharp rise in futures activity reflected heightened speculative trading following the protocol’s operational halt and security concerns. Traders increased leveraged positions as volatility expanded across cryptocurrency markets during the session. Meanwhile, THORChain teams continued investigating the exploit and monitoring suspicious wallet movements.

The incident added further pressure on decentralised finance platforms already facing regulatory scrutiny and persistent security threats. Cross-chain systems remain important for blockchain interoperability and decentralised asset transfers across networks. However, recurring exploits continue testing confidence in the sector’s long-term operational security.