THORChain appears to have been exploited across four blockchains — Bitcoin, Ethereum, BSC, and Base — with stolen funds exceeding $10 million, according to onchain investigator ZachXBT. The alert went out on his Telegram channel on Friday. Trading on the cross-chain liquidity protocol has been paused as the team investigates.
What the onchain data shows
ZachXBT posted the alert without attributing the exploit to any known threat actor. The losses, he said, topped $10 million. The attack hit multiple chains simultaneously, suggesting the attacker found a vulnerability in THORChain’s bridging logic or a router contract. At this point, no specific exploit vector has been confirmed by the project.
THORChain’s response
The protocol paused trading shortly after the alert spread. A halt like this is the standard emergency measure for a decentralized exchange when it detects suspicious outflows. THORChain has not yet released a post-mortem or a timeline for reopening. Users on social media reported that swap requests were failing across all supported chains.
What’s next
This is a developing story. The THORChain team is expected to publish a detailed incident report in the coming days — likely covering which contracts were exploited, whether user funds are at risk beyond the stolen amount, and what steps are being taken to prevent a repeat. For now, the protocol remains frozen, and the attacker’s wallet is being watched by multiple onchain sleuths.
