Thorchain halts trading after $10 million cross-chain exploit

[Oshosondy]

Thorchain’s RUNE token fell about 12% following the news after the exploit.

Wallets linked to the attacker currently hold roughly 3,443 ETH, 36.85 BTC and 96.6 BNB, while Thorchain’s RUNE token fell about 12 percent following the news.

Totally amount seen so far is $10.8 million across Bitcoin, Ethereum, BSC, and Base.

https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12

I have also been seeing the exploit on X.

[cLoazyL]

Thorchain’s RUNE token fell about 12% following the news after the exploit.

Wallets linked to the attacker currently hold roughly 3,443 ETH, 36.85 BTC and 96.6 BNB, while Thorchain’s RUNE token fell about 12 percent following the news.

Totally amount seen so far is $10.8 million across Bitcoin, Ethereum, BSC, and Base.

https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12

I have also been seeing the exploit on X.

The DPRK is also targeting places where they exchanged their dirty money, very interesting

[Yamane_Keto]

THORChain protocol team did not release any technical details, but it is worth noting that the protocol processed $394 million at the same time as the hack. I think hackers exploited this and found a vulnerability by making the contract believe a large deposit had been made, and then requested a refund, which leads to draining liquidity pools.

[cLoazyL]

THORChain protocol team did not release any technical details, but it is worth noting that the protocol processed $394 million at the same time as the hack. I think hackers exploited this and found a vulnerability by making the contract believe a large deposit had been made, and then requested a refund, which leads to draining liquidity pools.

You have some details there: https://x.com/depouch/status/2055275129333023113

But I'm still waiting for more informations!!

[TryNinja]

The DPRK is also targeting places where they exchanged their dirty money, very interesting

Money is money. They have no problem exploiting their own bridges.

At the end of the day, Thorchain will come back and they will keep using it.

[Bitcoin_Arena]

The DPRK is also targeting places where they exchanged their dirty money, very interesting

But how do people come up with theories that for some reason the massive hacks are always linked to the Democratic People's Republic of Korea? Even when the funds are just seated in some yet-to-be-identified addresses, the immediate suspect is North Korea. Back in the day it would also be Russian hackers or something along those lines. For some reason we never hear about anything about hackers from the UK or hackers from the US. Quite suspicious, isn't it?

[OmegaStarScream]

But how do people come up with theories that for some reason the massive hacks are always linked to the Democratic People's Republic of Korea? Even when the funds are just seated in some yet-to-be-identified addresses, the immediate suspect is North Korea. Back in the day it would also be Russian hackers or something along those lines. For some reason we never hear about anything about hackers from the UK or hackers from the US. Quite suspicious, isn't it?

It's usually the chain analytics companies that end up with that conclusion but in this hack, I don't believe anyone confirmed this.
@Oshosondy There are currently some fake accounts on X giving people links to claim their "losses", these are all fake[1] but somehow... Cointelegraph managed to fall for this and released an article about it[2].

[1] https://x.com/THORChain/status/2055593187922587697
[2] https://cointelegraph.com/news/thorchain-confirms-10m-exploit-rolls-out-recovery-portal-for-affected-users

[bitmover]

THORChain protocol team did not release any technical details, but it is worth noting that the protocol processed $394 million at the same time as the hack. I think hackers exploited this and found a vulnerability by making the contract believe a large deposit had been made, and then requested a refund, which leads to draining liquidity pools.

Lots of hacks happening because of AI. Those AI models are getting ververygood in finding bugs andy exploiting systems.

[Bitcoin_Arena]

>>snip<<

I second @OmegaStarScream

This is yet again another scam attempt. Just because an X account has a blue checkmark does not mean that it is legitimate, especially these days when it is worth a few bucks.

The official domain name: https://swap.thorchain.org/

Scam domain name:

Code:

https://revoke-thorchain.org/

The domain name was just registered yesterday 

Details

Code:

Domain: revoke-thorchain.org
Registered On: 2026-05-15
Expires On: 2027-05-15
Updated On: 2026-05-15

[honglu69]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

[Oshosondy]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

Some people will think only centralized exchanges can be hacked, but it is not like that. There has been few decentralized exchanges that have also been hacked, but the difference is that you do not have money on decentralized exchange unlike the centralized exchange rate you can have money, this reduce the chance that you may fall victim on a decentralized exchange.

[logfiles]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

No system is 100% secure, once in a while an attacker can make a break through. The source code being 100% open source does not make the service immune to attacks. There will always be new bugs even when an update is made.

I read their tweet, and they said that no user lost their funds in the attack but rather protocol owned funds so at least this is a sigh of relief to the users. Had it been a centralized exchange, it would be a whole new different thing.

[honglu69]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

No system is 100% secure, once in a while an attacker can make a break through. The source code being 100% open source does not make the service immune to attacks. There will always be new bugs even when an update is made.

I read their tweet, and they said that no user lost their funds in the attack but rather protocol owned funds so at least this is a sigh of relief to the users. Had it been a centralized exchange, it would be a whole new different thing.

no user "lost" fund in thorchain eco system is false claim.  Thorchain Liquidity pool owner is "user",  LP user lost a lot in the past. They even closed redeeming pushed all loss to LP users.  by the way, LP users initially were attracted by fat yield and the "Impermanent loss protection guarentee" which was later removed.

At best, thorchain is bait and switch to LP owners.  Yes, DEX is good, but komodo dex and Cheetahdex is another dex technology too based on atomic swap tech base, not thorchain alone.