Cross-chain liquidity protocol THORChain temporarily halted trading and signing operations on Friday after blockchain investigators flagged a suspected exploit that appears to have drained more than $10 million across multiple networks, including Bitcoin, Ethereum, BNB Smart Chain, and Base.
The emergency pause was activated after on-chain analyst ZachXBT and security firm PeckShield identified suspicious wallet activity tied to coordinated transfers moving through THORChain linked infrastructure.
A message shared through THORChain’s alerts channel stated that trading would remain paused until block 26191149 while validators investigate the incident and assess the extent of the damage. The protocol had not released an official post-mortem at the time of publication, and the exact attack vector remains unclear.
Key Takeaways
- THORChain temporarily halted trading and signing operations after a suspected exploit reportedly drained more than $10 million across multiple blockchains.
- Investigators traced suspicious wallet activity involving Bitcoin, Ethereum, BNB Smart Chain, and Base-linked assets.
- THORChain’s native token RUNE fell around 12% following the incident as traders reacted to the network pause and uncertainty.
- The exploit renewed concerns around the security risks facing cross-chain liquidity protocols and bridge infrastructure.
- The incident adds to growing pressure on DeFi platforms to strengthen safeguards as bridge-related hacks continue targeting multi-chain systems.
Exploit spreads across several blockchains
Early blockchain data suggests the suspected attacker moved funds through wallets connected to both Bitcoin and EVM-compatible chains in a series of rapid transactions.
According to analytics platform Arkham Intelligence, wallets linked to the exploiter were holding roughly $10.8 million shortly after the incident surfaced publicly. The assets reportedly included 3,443 ETH, 36.85 BTC, and 96.6 BNB alongside smaller token balances spread across several addresses.
PeckShield also flagged suspicious transfers involving bitcoin and Ethereum linked assets, while ZachXBT initially estimated losses above $7 million before later revising the figure higher as more transactions were traced on-chain.
The protocol’s built-in emergency controls automatically halted swaps and trading activity shortly after the exploit was detected. Native RUNE transfers continued operating while validators coordinated the response. The incident immediately renewed concerns around the security of cross-chain liquidity systems, which remain one of the most targeted sectors in decentralized finance because of the large pools of capital they manage across multiple blockchains.
RUNE slides as traders react to the halt
THORChain’s native token, RUNE, dropped sharply following news of the exploit and the network pause.
CoinGecko data showed the token falling roughly 12% to 13% within 24 hours, briefly trading near $0.50 before stabilizing slightly above that level later in the session. The latest decline adds to an already difficult year for RUNE holders. The token has now lost more than 70% of its value over the past 12 months amid broader weakness across the DeFi market and recurring security concerns tied to cross-chain infrastructure.
Trading activity surged as the selloff accelerated. Derivatives data from CoinGlass showed a sharp increase in futures open interest following the exploit alerts, suggesting traders quickly repositioned around the volatility.
Analysts warned that conditions remain unstable until THORChain fully restores trading and publishes technical details explaining how the exploit occurred.
Security pressure returns to DeFi
The latest exploit comes during a period of mounting pressure on decentralized finance protocols.
According to DefiLlama data, DeFi projects lost more than $634 million to hacks and exploits in April alone, marking the sector’s worst monthly security losses since February 2025, when crypto exchange Bybit suffered a record $1.4 billion breach. Cross-chain protocols have repeatedly emerged as high-risk targets because they connect liquidity pools and messaging systems across multiple blockchains.
THORChain itself has frequently appeared in investigations involving stolen crypto assets moving between networks. Earlier this year, attackers connected to the roughly $293 million Kelp DAO exploit reportedly routed tens of thousands of ETH through THORChain while laundering stolen funds. The protocol also faced internal financial pressure earlier in 2025 after pausing its ThorFi lending service due to insolvency concerns. THORChain later restructured operations and addressed nearly $200 million in liabilities through a validator backed recovery plan.
Those earlier problems had already placed scrutiny on the project’s risk controls before Friday’s exploit reignited concerns around operational security.
Industry focus shifts back to bridge vulnerabilities
Security researchers say cross-chain bridges and liquidity systems continue to represent one of the weakest points in crypto infrastructure.
Blockchain analytics firm Chainalysis previously estimated that bridge-related exploits have accounted for billions of dollars in stolen digital assets since 2021, largely because attackers can exploit weaknesses between connected networks rather than targeting a single blockchain directly.
The latest THORChain incident is likely to intensify calls for stronger safeguards across DeFi protocols handling multi-chain liquidity.
For now, traders and liquidity providers remain focused on whether THORChain can safely resume operations without additional disruptions.
Neither THORChain developers nor validators had confirmed whether user funds beyond the currently identified wallets remain at risk as of publication.
