THORChain Halts Trading After $10M Cross-Chain Exploit

THORChain, a decentralized cross-chain liquidity protocol, halted all trading on May 15, 2026, after blockchain investigators flagged a suspected exploit that drained more than $10 million across Bitcoin, Ethereum, BNB Smart Chain and Base networks.

Blockchain researcher ZachXBT first alerted the community via Telegram, identifying theft addresses on Bitcoin (bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37) and Ethereum (0x82fc0d5150f3548027e971ec04c065f3c93154eb), along with activity on BNB Smart Chain and Base. Security firm PeckShield corroborated the findings. On-chain data showed the addresses holding approximately 36.85 BTC, more than 216 ETH, 96.6 BNB and other tokens including USDT, USDC and WBTC, with an initial loss estimate of $7.4 million revised upward to at least $10 million after further accounting. The attack targeted the protocol's Asgard vaults and router contracts simultaneously across the four chains, highlighting the technical complexity involved.

In response, THORChain nodes activated a global emergency halt, pausing trading and signing operations until block 26191149, about 12 hours and 42 minutes from initiation. The protocol's security documentation describes...