THORChain stopped trading this morning after a suspected $10 million exploit that on-chain investigator ZachXBT flagged across Bitcoin, Ethereum, BNB Chain, and Base. The cross-chain liquidity protocol confirmed it had paused all trading activity while it investigates the incident, which appears to involve unauthorized withdrawals from its pools.
The suspected exploit
ZachXBT posted a public alert around 9:00 AM UTC on May 15, pointing to a series of transactions draining funds from THORChain's liquidity pools. The transactions hit multiple chains simultaneously — Bitcoin, Ethereum, BNB Chain, and Base — suggesting an attacker found a way to bypass the protocol's security checks. The total at risk is roughly $10 million, though THORChain hasn't confirmed a final figure yet.
How THORChain responded
The exchange's native token, RUNE, dropped sharply as word spread. THORChain's team said it halted all trading as a precaution, locking the smart contracts that handle swaps. Users trying to swap during the pause saw error messages instead of confirmations. The protocol's official Telegram channel went quiet after a brief statement that they were 'looking into it.'
THORChain's whole pitch is trustless cross-chain swapping — no wrapped tokens, no synthetic assets. If an attacker managed to drain native assets directly, that's a tough problem to patch. The exploit also highlights how hard it is to secure multi-chain infrastructure. This isn't the first time THORChain has faced a security scare; it suffered a major bug in July 2021 that led to a temporary halt.
As of this afternoon, THORChain hasn't said when trading will resume. Users holding funds in the protocol are waiting for a post-mortem — and hoping the $10 million figure doesn't climb.
