Cross-chain liquidity protocol THORChain temporarily halted trading on Friday after blockchain security researchers flagged a suspected exploit involving Bitcoin, Ethereum, BNB Smart Chain and Base.
The protocol announced in its Telegram channel that trading would remain paused for about 12 hours, until block 26191149, while the incident is investigated. The suspension followed alerts from on-chain investigator ZachXBT and blockchain security firm PeckShield, both of which identified suspicious wallet activity linked to potential thefts across multiple networks.
Suspected exploit moves funds across multiple chains
According to the investigators, the suspected attacker used wallets on both the Bitcoin network and EVM-compatible chains. While the exploit has not yet been officially confirmed by THORChain, early estimates suggest losses may have exceeded $10 million.
Blockchain analytics platform Arkham labelled one wallet as belonging to the suspected exploiter. The wallet reportedly held about $10.8 million after a series of smaller transfers made within a short period before 10:11 a.m. UTC.
The incident quickly triggered concerns across the crypto market, especially as cross-chain protocols remain major targets for hackers due to the large amount of liquidity they manage.
RUNE drops 13% as traders react
The suspected exploit weighed heavily on THORChain’s native token, RUNE. The token fell 13% within 24 hours and traded slightly above $0.50 by 10:20 a.m. UTC, according to CoinGecko data.
RUNE has now declined roughly 72% over the past year, reflecting ongoing pressure from security incidents and broader market weakness.
The latest decline also comes during a difficult period for decentralized finance. DeFi platforms lost more than $634 million to hacks in April alone, according to DefiLlama data. That marked the highest monthly loss since February 2025, when hackers stole about $1.4 billion from crypto exchange Bybit.
THORChain faces renewed security questions
The latest incident adds to a growing list of operational and security issues tied to THORChain.
In January 2025, the protocol paused its ThorFi lending service following insolvency concerns before restructuring its operations through validators. The project later resolved a $200 million debt crisis by converting liabilities into a new equity-style token.
THORChain has also repeatedly appeared in investigations involving stolen crypto funds being moved across chains, including the recent Kelp DAO exploit.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools
