THORChain resumed trading this week after a five-week pause that followed a $10.7 million exploit. The cross-chain liquidity protocol had been offline since mid-May, when attackers drained funds from its network. The restart marks the end of the longest operational halt in THORChain's history.
What happened during the halt
The exploit hit THORChain on May 18, forcing the team to halt trading almost immediately. Investigators later pinned the damage at $10.7 million. The protocol's native RUNE token took a hit in the hours after the breach, though prices have partially recovered during the downtime. Developers spent the five weeks auditing the code, patching vulnerabilities, and coordinating with validators to ensure a safe restart.
How the restart unfolded
Trading resumed on June 22 after a community vote to re-enable the network. Users could withdraw and swap assets again — many had been stuck for weeks. The team said it would reimburse affected users through a combination of treasury funds and future fee revenue. Not everyone got their money back immediately; some claims are still being processed.
What the exploit means for cross-chain security
The incident isn't an isolated one. THORChain's model — letting users swap assets across blockchains without wrapping tokens — relies on complex smart contracts that handle real-time settlement. That architecture has been probed before, and this latest breach underscores a broader challenge: as cross-chain protocols grow, so does the attack surface. Expect teams building similar infrastructure to double down on formal verification and slower rollout schedules. The pause itself, while painful, may become a blueprint for how to handle exploits without a full collapse.
What's next? THORChain's developers are still working through the reimbursement backlog. The next major test will be whether users return in the same numbers — trust, once broken, takes more than a patch to rebuild.
