A coordinated exploit hit THORChain early this week, with attackers making off with at least $10 million in assets across four networks. On-chain investigator ZachXBT first flagged the suspicious movements, initially estimating losses above $.4 million before revising the figure upward. The breach targeted Bitcoin, Ethereum, BNB Chain, and Base simultaneously, exploiting vulnerabilities in THORChain's cross-chain router infrastructure.
How the exploit unfolded
Blockchain tracking firm Arkham Intelligence labeled several wallets as 'THORChain Exploiter' addresses. Among them: a Bitcoin wallet holding roughly 6.85 BTC — worth about $ million at current prices — and an Ethereum wallet containing about 6 ETH. PeckShield independently confirmed the breach, estimating losses of roughly 6.75 BTC (~$ million) from Bitcoin plus another $ million combined from Ethereum, BNB Chain, and Base. The stolen assets remain visible on-chain in the flagged wallets, untouched as of this writing.
Market reaction and silence from THORChain
THORChain's native token RUNE took an immediate hit, sliding nearly 4% toward $0.50. The timing isn't great for a protocol already under scrutiny for cross-chain security. As of this report, THORChain has not issued a public statement about the exploit or any remediation steps. That silence is amplifying market anxiety — users and liquidity providers are left guessing whether funds are safe or if withdrawals will be paused.
Cross-chain infrastructure under fire again
This isn't an isolated incident. Cross-chain bridges and routers have been a recurring pain point in DeFi, with complex code often hiding subtle attack surfaces. THORChain's design — allowing native asset swaps without wrapped tokens — is innovative, but it also creates a large attack surface. The exploit hit Bitcoin, Ethereum, BNB Chain, and Base in one go, underscoring how a single vulnerability in the router can cascade across multiple chains.
ZachXBT and Arkham continue to track the stolen funds. Whether THORChain will activate any emergency measures or coordinate with law enforcement remains an open question. For now, the flagged wallets sit — and the DeFi community is watching closely.
