Key Takeaways
- Renowned blockchain sleuth ZachXBT identified a massive $10M+ security breach affecting THORChain across Bitcoin, Ethereum, BSC, and Base networks
- The protocol immediately activated emergency shutdown protocols, freezing all trading and swap operations to safeguard liquidity provider funds
- Hacker-controlled addresses accumulated 36.85 BTC, 3,443 ETH, and 96.6 BNB alongside various other digital assets
- RUNE token value plunged as much as 15% after the breach disclosure, sliding from $0.58 down to approximately $0.50
- RUNE futures open interest surged 19% within a four-hour window, indicating significant derivatives market activity amid the price decline
On May 15, 2026, THORChain—a decentralized protocol enabling cross-chain liquidity swaps—became the victim of a sophisticated exploit exceeding $10 million in value. The security incident was initially brought to light by prominent blockchain investigator ZachXBT, who documented suspicious outflows spanning four distinct blockchain networks.
The compromise affected Bitcoin, Ethereum, BNB Smart Chain, and Base protocols. Malicious actors siphoned funds by exploiting THORChain’s router smart contracts deployed across these networks.
Blockchain analytics service Arkham traced the stolen assets to specific attacker-controlled wallets. These addresses contained 36.85 BTC, 3,443 ETH, and 96.6 BNB, in addition to stablecoins like USDT and USDC, plus wrapped Bitcoin (WBTC).
ZachXBT’s preliminary assessment placed losses at approximately $7.4 million. Following additional blockchain analysis, he revised this estimate upward to a minimum of $10 million.
Protocol Activates Emergency Shutdown Procedures
Following detection of the security breach, THORChain immediately deployed its integrated emergency response mechanism. The global HaltTrading parameter brought all trading and exchange functionality across supported blockchains to a complete stop.
Despite this emergency measure, the THORChain blockchain infrastructure and native RUNE token transfers remained operational. This selective shutdown strategy aims to minimize additional losses while network validators investigate the incident’s scope.
Multiple security monitoring services, including PeckShieldAlert, quickly identified and flagged the attacker’s wallet addresses following the public disclosure. The protocol’s validator nodes automatically suspended operations according to pre-programmed emergency response protocols.
ZachXBT additionally criticized an unnamed third-party account that republished the alert without conducting independent verification. He noted they failed to authenticate the loss amounts or confirm which blockchain networks were compromised.
Token Value Experiences Sharp Decline
RUNE experienced approximately 15% depreciation within minutes following widespread circulation of ZachXBT’s disclosure. The digital asset declined from above $0.58 to approximately $0.50 before finding temporary support.
As of publication, RUNE was changing hands around $0.52. The token’s 24-hour trading range extended from $0.502 to $0.597.
Trading volume expanded nearly 140% over 24 hours as market participants liquidated positions. Interestingly, derivatives markets exhibited contrary momentum to spot price action.
According to CoinGlass metrics, THORChain futures open interest climbed over 6% to $24.80 million in just one hour. RUNE futures open interest expanded 19% across four hours, with leading exchanges Binance and Bybit recording increases of approximately 17% and 19% respectively.
RUNE’s total market capitalization hovered near $204.88 million prior to comprehensive price updates across market data platforms. The token has declined more than 70% over the trailing twelve months.
This incident marks the second time THORChain has attracted negative attention in 2026. During April, approximately $175 million in ETH from the ~$290 million Kelp DAO security breach was laundered through THORChain as attackers distributed funds across numerous wallet addresses.
That previous incident generated concerns regarding cross-chain asset recovery capabilities, as stolen cryptocurrencies become increasingly difficult to track when transferred across multiple blockchain ecosystems.
