THORChain exploit drains $10M+ across four chains

On Friday, onchain investigator ZachXBT posted on Telegram identifying a multi-chain exploit on THORChain that removed more than $10 million. He supplied three addresses tied to the transfers: bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37, 0x82fc0d5150f3548027e971ec04c065f3c93154eb and 0xd477b69551f49c0519f9b18c55030676138890bd.

Independent onchain tracking shows the total value taken from the protocol has topped $10 million. The activity spans Bitcoin, Ethereum, BNB Chain and Base.

After the alert, THORChain paused trading on its platform. The protocol has not released a full technical explanation of the incident.

The suspected theft weighed on the protocol’s native token, RUNE. Market data shows RUNE fell more than 6% following the alert and was trading around $0.50 at the time of reporting.

The exploit appears to have targeted THORChain’s cross-chain and liquidity functions that move assets between blockchains. Developers and independent security analysts are reviewing onchain traces and node logs to determine the attack vector and whether funds can be recovered.

THORChain provides cross-chain liquidity and native asset swaps and uses RUNE as its governance and liquidity token. The project has previously paused operations while investigating irregular activity.

The situation remains under investigation. Further technical analysis and any official statements from THORChain or associated maintainers are needed to clarify the scope of the breach and next steps for affected users.