Key Takeaways
- On-chain sleuth ZachXBT identified a multi-chain security breach on THORChain resulting in over $10 million in stolen funds across Bitcoin, Ethereum, BSC, and Base networks
- The protocol immediately activated emergency shutdown procedures, suspending all trading and swap functionality to safeguard remaining liquidity
- Identified attacker addresses currently contain 36.85 BTC, 3,443 ETH, and 96.6 BNB alongside various stablecoins
- RUNE token value plummeted as much as 15% in response to the breach, sliding from $0.58 down to approximately $0.50
- Despite spot market selling pressure, RUNE futures open interest surged 19% within a four-hour window, indicating significant derivatives trading activity
On May 15, 2026, THORChain—a decentralized protocol enabling cross-chain liquidity—became the victim of a security exploit exceeding $10 million in value. The attack was first brought to public attention by prominent blockchain sleuth ZachXBT, who documented suspicious fund movements spanning multiple blockchain networks.
The security breach impacted four major blockchain ecosystems: Bitcoin, Ethereum, BNB Smart Chain, and Base. Unauthorized fund withdrawals occurred through THORChain’s router smart contracts deployed on each of these networks.
Blockchain analytics service Arkham successfully traced the attacker’s wallet addresses. Current holdings in these addresses include 36.85 BTC, 3,443 ETH, and 96.6 BNB, in addition to substantial amounts of USDT, USDC, and wrapped Bitcoin.
ZachXBT’s preliminary assessment placed the stolen amount above $7.4 million. Following additional blockchain analysis and transaction verification, he revised the total loss figure upward to a minimum of $10 million.
Protocol Activates Emergency Response System
Following detection of the unauthorized withdrawals, THORChain immediately deployed its integrated emergency halt functionality. This system-wide HaltTrading configuration effectively froze all trading operations and token swaps across every connected blockchain network.
While this emergency measure stops cross-chain activity, the THORChain blockchain infrastructure and native RUNE token transfers remain operational. This protective mechanism aims to prevent additional losses while the network’s node operators conduct a comprehensive security investigation.
Multiple security monitoring services, including PeckShieldAlert, quickly identified and flagged the suspected attacker wallets following the initial disclosure. The protocol’s decentralized node network automatically suspended operations as programmed within the emergency response framework.
ZachXBT additionally criticized a third-party social media account that republished the exploit information without performing independent verification. He noted they failed to confirm the reported figures or validate which blockchain networks were actually compromised.
Token Experiences Sharp Decline
RUNE experienced an immediate 15% price collapse within minutes of ZachXBT’s public disclosure gaining traction across social media platforms. The digital asset declined from above $0.58 to approximately $0.50 before finding temporary support.
As of publication, RUNE was changing hands around $0.52. The token’s 24-hour trading range extended from a low of $0.502 to a high of $0.597.
Spot market trading volume exploded nearly 140% over the preceding 24 hours as market participants rushed to exit positions. Interestingly, derivatives markets demonstrated contrasting behavior during the same period.
According to CoinGlass analytics, THORChain futures open interest increased more than 6% to reach $24.80 million in just one hour. RUNE futures open interest expanded 19% across a four-hour timeframe, with major exchanges Binance and Bybit recording increases of approximately 17% and 19% respectively.
RUNE’s total market capitalization hovered near $204.88 million prior to full price adjustments being reflected across major tracking platforms. The token has lost over 70% of its value throughout the past twelve months.
This incident marks the second time THORChain has faced security-related scrutiny in 2026. During April, proceeds from the approximately $290 million Kelp DAO security breach were channeled through THORChain’s infrastructure as attackers redistributed roughly $175 million in ETH across fresh wallet addresses.
That previous incident sparked debate regarding cross-chain asset recovery capabilities, as stolen digital assets become increasingly difficult to track when dispersed across numerous blockchain networks.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
