THORChain Exploited for $7.4M, Protocol Pauses Trading

ZachXBT flagged the incident on his Telegram channel around 09:45 UTC on May 15. OnchainLens amplified the alert on X shortly after. Within minutes, community developers confirmed a global pause had been executed.

What the THORChain Exploit Data Shows

Arkham Intelligence has labeled the suspected attacker as “Thorchain Exploiter.” At the time of labeling, the entity held approximately $6.57 million in stolen assets. That total breaks down to 36.85 BTC, 1,567 ETH, and 96.59 BNB.

The suspected attacker’s EVM wallet (0x82fc…4eb) shows rapid activity in the last hour. It includes a 1,866 ETH outflow worth roughly $4.2 million. The wallet also shows multiple swaps routed through 1inch and Kyber.

A suspected Bitcoin address, bc1q14u94k1k2651nfur2ujk9p6uh52f2a8jhf6f37, has also been linked to the attacker. No public Dune or DefiLlama dashboards track the THORChain exploit impact yet because the incident is too recent.

As of 10:00 UTC, the THORChain team has not released an official statement or post-mortem.

How THORChain Works and Why It Matters

THORChain enables native cross-chain swaps without wrapped tokens or traditional bridges. It uses liquidity pools and validator-run Asgard vaults. The Bifrost observer module watches deposits across chains, while TSS vaults require 67% node consensus to sign outbound transactions.

This architecture makes cross-chain swaps possible but also creates a broad attack surface. If an attacker can trick Bifrost into processing fake deposits, they can drain vault funds across multiple chains at once.

The suspected exploit likely targeted this mechanism. The full attack vector remains unconfirmed pending the team’s post-mortem.

THORChain’s History of Security Incidents

This is not THORChain’s first security crisis. In July 2021, attackers exploited the ETH Router twice within two weeks. Those incidents cost the protocol roughly $13 million. In both cases, attackers tricked Bifrost into crediting fake deposits.

The protocol also faced scrutiny in 2022 and 2023. North Korea’s Lazarus Group reportedly used THORChain swaps to launder stolen crypto. That controversy raised broader questions about cross-chain protocol accountability.

Today’s incident brings the total number of major THORChain security events to at least three. Each one has involved the core Bifrost and vault infrastructure.

THORChain Price Drops 11% as Markets React

RUNE, THORChain’s native token, fell 11.3% in 24 hours to $0.5130, according to CoinGecko data. The 24-hour trading range hit a low of $0.5125 and a high of $0.5979. Trading volume spiked to $35.3 million.

THORChain’s total value locked (TVL) stands at $41.95 million, according to DefiLlama. That figure is down 2.73% in the last 24 hours. For context, the protocol’s TVL peaked above $500 million in early 2022.

Community Reaction and Open Questions

Social media reaction has been swift. Dominant sentiment on X reflects alarm and frustration. Multiple accounts posted urgent alerts, and the narrative of “THORChain can’t stop getting hacked” quickly resurfaced.

ZachXBT described the incident as a likely exploit. Most community reports align with that assessment. Some early accounts raised the possibility that funds may have been laundered through the protocol from another hack. Arkham’s explicit “Thorchain Exploiter” label points toward a direct protocol-level exploit.

Several critical questions remain unanswered. The exact technical root cause is unknown. The per-chain breakdown of losses has not been disclosed. Whether user deposits beyond vault liquidity are affected remains unclear.

What Comes Next After THORChain Is Exploited

The protocol remains paused as of this writing. The community is waiting for an official post-mortem from the THORChain team. That report should explain the attack vector, confirm total losses, and outline steps to prevent a recurrence.

For now, users should avoid interacting with THORChain until the team confirms the issue is resolved. Cross-chain protocols continue to carry elevated security risks, and this incident reinforces that reality.

This is a developing story. OCT will update this article as more information becomes available.

This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.