Thorchain halts trading after $10 million cross-chain exploit

[Oshosondy]

Thorchain’s RUNE token fell about 12% following the news after the exploit.

Wallets linked to the attacker currently hold roughly 3,443 ETH, 36.85 BTC and 96.6 BNB, while Thorchain’s RUNE token fell about 12 percent following the news.

Totally amount seen so far is $10.8 million across Bitcoin, Ethereum, BSC, and Base.

https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12

I have also been seeing the exploit on X.

[cLoazyL]

Thorchain’s RUNE token fell about 12% following the news after the exploit.

Wallets linked to the attacker currently hold roughly 3,443 ETH, 36.85 BTC and 96.6 BNB, while Thorchain’s RUNE token fell about 12 percent following the news.

Totally amount seen so far is $10.8 million across Bitcoin, Ethereum, BSC, and Base.

https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12

I have also been seeing the exploit on X.

The DPRK is also targeting places where they exchanged their dirty money, very interesting

[Yamane_Keto]

THORChain protocol team did not release any technical details, but it is worth noting that the protocol processed $394 million at the same time as the hack. I think hackers exploited this and found a vulnerability by making the contract believe a large deposit had been made, and then requested a refund, which leads to draining liquidity pools.

[cLoazyL]

THORChain protocol team did not release any technical details, but it is worth noting that the protocol processed $394 million at the same time as the hack. I think hackers exploited this and found a vulnerability by making the contract believe a large deposit had been made, and then requested a refund, which leads to draining liquidity pools.

You have some details there: https://x.com/depouch/status/2055275129333023113

But I'm still waiting for more informations!!

[TryNinja]

The DPRK is also targeting places where they exchanged their dirty money, very interesting

Money is money. They have no problem exploiting their own bridges.

At the end of the day, Thorchain will come back and they will keep using it.

[Bitcoin_Arena]

The DPRK is also targeting places where they exchanged their dirty money, very interesting

But how do people come up with theories that for some reason the massive hacks are always linked to the Democratic People's Republic of Korea? Even when the funds are just seated in some yet-to-be-identified addresses, the immediate suspect is North Korea. Back in the day it would also be Russian hackers or something along those lines. For some reason we never hear about anything about hackers from the UK or hackers from the US. Quite suspicious, isn't it?

[OmegaStarScream]

But how do people come up with theories that for some reason the massive hacks are always linked to the Democratic People's Republic of Korea? Even when the funds are just seated in some yet-to-be-identified addresses, the immediate suspect is North Korea. Back in the day it would also be Russian hackers or something along those lines. For some reason we never hear about anything about hackers from the UK or hackers from the US. Quite suspicious, isn't it?

It's usually the chain analytics companies that end up with that conclusion but in this hack, I don't believe anyone confirmed this.
@Oshosondy There are currently some fake accounts on X giving people links to claim their "losses", these are all fake[1] but somehow... Cointelegraph managed to fall for this and released an article about it[2].

[1] https://x.com/THORChain/status/2055593187922587697
[2] https://cointelegraph.com/news/thorchain-confirms-10m-exploit-rolls-out-recovery-portal-for-affected-users

[bitmover]

THORChain protocol team did not release any technical details, but it is worth noting that the protocol processed $394 million at the same time as the hack. I think hackers exploited this and found a vulnerability by making the contract believe a large deposit had been made, and then requested a refund, which leads to draining liquidity pools.

Lots of hacks happening because of AI. Those AI models are getting ververygood in finding bugs andy exploiting systems.

[Bitcoin_Arena]

>>snip<<

I second @OmegaStarScream

This is yet again another scam attempt. Just because an X account has a blue checkmark does not mean that it is legitimate, especially these days when it is worth a few bucks.

The official domain name: https://swap.thorchain.org/

Scam domain name:

Code:

https://revoke-thorchain.org/

The domain name was just registered yesterday 

Details

Code:

Domain: revoke-thorchain.org
Registered On: 2026-05-15
Expires On: 2027-05-15
Updated On: 2026-05-15

[honglu69]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

[Oshosondy]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

Some people will think only centralized exchanges can be hacked, but it is not like that. There has been few decentralized exchanges that have also been hacked, but the difference is that you do not have money on decentralized exchange unlike the centralized exchange rate you can have money, this reduce the chance that you may fall victim on a decentralized exchange.

[logfiles]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

No system is 100% secure, once in a while an attacker can make a break through. The source code being 100% open source does not make the service immune to attacks. There will always be new bugs even when an update is made.

I read their tweet, and they said that no user lost their funds in the attack but rather protocol owned funds so at least this is a sigh of relief to the users. Had it been a centralized exchange, it would be a whole new different thing.

[honglu69]

Thorchain is hacked again and swap halted. Thorchain is over rated due to security risk and komodo dex tech is underrated. Nobody understand thorchain source code other than it's dev. Too complicated while komodo wallet dex source code is a lot easier to understand and its source code is 100% open sourced and komodo fork Cheetahdex wallet/dex is readily available for those who want to run wallet dex to trade immediately.

No system is 100% secure, once in a while an attacker can make a break through. The source code being 100% open source does not make the service immune to attacks. There will always be new bugs even when an update is made.

I read their tweet, and they said that no user lost their funds in the attack but rather protocol owned funds so at least this is a sigh of relief to the users. Had it been a centralized exchange, it would be a whole new different thing.

no user "lost" fund in thorchain eco system is false claim.  Thorchain Liquidity pool owner is "user",  LP user lost a lot in the past. They even closed redeeming pushed all loss to LP users.  by the way, LP users initially were attracted by fat yield and the "Impermanent loss protection guarentee" which was later removed.

At best, thorchain is bait and switch to LP owners.  Yes, DEX is good, but komodo dex and Cheetahdex is another dex technology too based on atomic swap tech base, not thorchain alone.

[_act_]

no user "lost" fund in thorchain eco system is false claim.  Thorchain Liquidity pool owner is "user",  LP user lost a lot in the past. They even closed redeeming pushed all loss to LP users.  by the way, LP users initially were attracted by fat yield and the "Impermanent loss protection guarentee" which was later removed.

At best, thorchain is bait and switch to LP owners.  Yes, DEX is good, but komodo dex and Cheetahdex is another dex technology too based on atomic swap tech base, not thorchain alone.

I do not know about THORChain until recently, and logfiles is referring to the recent attack, not all the attacks on THORChain, which I do not know about.

According to what has been online, attackers exploited the protocol's asgard vaults, but only the protocol's funds were affected, while the users funds are protected. No user has also come out to say he is affected.

Those that are saying there is a recovery for users that lost money are all scam and fake recovery because no one is affected.

THORChain developers are genius.

[honglu69]

In dex world,  more competition is better.  We need more dex wallet option, not just use Thorchain. For users, we should separate trader as user in one bucket, and yield earner user as another bucket as "yield user".  For yield user, Thorchain LP business model is dead. The team need to put up market making liquidity dollar to support pairs. The team needs to put $25k to $50k USD into thorchain to get huge liquidity benefit for traders.

Thorchain:  great for trader users, sucks for yield earner because it is almost scam for LP users. Do not put your coins into Thorchain into LP.  Other than LP, I do believe thorchain is great DEX product and has its real true usage and trade off.  Team usually need to put up LP to support, $25k to $50K USD equivalent for market making  like CEX based on newest info there.

AMM ERC traditional style: great, but only works for BNP ETH style EVM chain.


Komodo dex:  great for decentralization, open sourced fork like Cheetahdex allowing trading. It has problem on liquidity. But open sourced tool available to allow team to deploy liquidity into wallet DEX. True decentralized P2P swap and wallet.   Why not consider putting some liquidity into true P2P like Komodo dex (cheetahdex), you own code, put up some seednode spinning running.  very low risk of hack.  

[Yamane_Keto]

Some people will think only centralized exchanges can be hacked, but it is not like that. There has been few decentralized exchanges that have also been hacked

We cannot call 'hacking' to decentralized system. If a DEX was hacked, it is definitely centralized. What happened with Thorchain was the exploitation of a vulnerability that led to the loss of funds from liquidity providers, and those who use the protocol to conduct the exchange are not harmed.