$10M Security Breach Suspected: THORChain Freezes All Trading Operations
Following blockchain sleuth ZachXBT's alert regarding a potential $10 million security breach affecting Bitcoin, Ethereum, BNB Chain and Base networks, THORChain has suspended all trading activities.
The decentralized liquidity protocol known as THORChain has suspended all trading operations following a report from blockchain sleuth ZachXBT who identified what appears to be a security breach involving more than $10 million in digital assets.
According to updates posted to THORChain's alerts Telegram channel, both trading and signing operations have been completely suspended, with a network-wide node pause implemented through block 26191149, representing approximately 12 hours and 42 minutes. This emergency shutdown was initiated moments after ZachXBT publicly reported that the protocol appeared to have been compromised across multiple blockchain networks including Bitcoin, Ethereum, BNB Chain and Base.
Data from Arkham Intelligence revealed that a cryptocurrency wallet identified as belonging to the THORChain exploiter contained holdings totaling $10.8 million, which had been transferred through multiple smaller transactions during a 30-minute window preceding 10:11 am UTC.
This potential security breach contributes to growing apprehension surrounding the safety of decentralized finance (DeFi) protocols, following a month in which malicious actors successfully stole in excess of $634 million throughout April, representing the largest monthly theft total since the $1.46 billion recorded in February 2025, when cybercriminals executed the record-breaking $1.4 billion attack on Bybit exchange, according to information from DefiLlama data.
Cointelegraph has attempted to contact THORChain for an official statement. At the time this article was published, the protocol had not issued any public confirmation regarding the exploit, although both ZachXBT and PeckShield had identified suspicious transactions, and THORChain's official alert systems indicated that trading and signing operations had been suspended.
RUNE token drops 13% in wake of potential security incident
The native RUNE token of THORChain experienced a decline of approximately 13% in the aftermath of the suspected security breach and was changing hands near the $0.51 level at the time this report was compiled, based on data provided by CoinGecko.
This most recent price decline compounds existing downward momentum on the token's valuation, which has decreased by 72% over the preceding twelve-month period.
Due to its design as a non-custodial cross-chain protocol, THORChain has been frequently utilized by bad actors seeking to exchange illicitly obtained digital assets, despite not functioning as a cryptocurrency mixing service similar to Tornado Cash.
In an incident earlier during April, the perpetrator responsible for the $293 million Kelp DAO security breach exchanged 75,700 Ether (ETH) via THORChain, which resulted in approximately $910,000 in fees for the protocol.
The bulk of the $1.4 billion in cryptocurrency taken during the Bybit security incident, representing roughly $1.2 billion, was similarly routed through THORChain by the attackers, who converted it from Ether to Bitcoin, as stated by Bybit co-founder and CEO Ben Zhou.