THORChain Halts Trading After ZachXBT Flags $10M Exploit

Decentralized liquidity protocol THORChain halted trading after blockchain investigator ZachXBT flagged a suspected exploit of more than $10 million.

A THORChain alerts Telegram channel showed all trading and signing halted, with a global node pause extended until block 26191149, or roughly 12 hours and 42 minutes. The halt came shortly after ZachXBT said the protocol had likely been exploited across Bitcoin, Ethereum, BNB Chain and Base.

A wallet labeled by Arkham as the THORChain exploiter showed $10.8 million in holdings, transferred across several smaller transactions in the 30 minutes before 10:11 am UTC.

The suspected exploit adds to the mounting security concerns around decentralized finance (DeFi) protocols, after hackers stole over $634 million during April, marking the highest monthly sum since the $1.46 billion in February 2025, when hackers staged the record $1.4 billion hack on Bybit exchange, DefiLlama data shows.

Cointelegraph reached out to THORChain for comment. The protocol had not publicly confirmed the exploit at the time of publication, though ZachXBT and PeckShield flagged suspicious activity, and THORChain alerts showed trading and signing had been halted.

Thorchain exploiter-tagged wallet. Source: Arkham

RUNE price falls 13% after suspected exploit 

THORChain’s RUNE token fell by around 13% following the suspected exploit and traded near $0.51 at the time of writing, according to CoinGecko data.

RUNE/USD, one-day chart. Source: CoinGecko

The latest correction adds additional pressure to the token’s price action, which is down 72% during the past year.

Related: Kelp DAO exploit prompts DeFi protocols to rethink oracle providers

As a non-custodial cross-chain protocol, THORChain has repeatedly been used by malicious actors to swap stolen funds, though it is not a cryptocurrency mixer like Tornado Cash.

Earlier in April, the attacker behind the $293 million Kelp DAO exploit swapped 75,700 Ether (ETH) through THORChain, generating about $910,000 in revenue for the protocol.

The majority of the $1.4 billion stolen during the Bybit hack, or about $1.2 billion, was also moved through THORChain by hackers, who swapped it from Ether to Bitcoin, according to Bybit co-founder and CEO Ben Zhou.