THORChain, whose native token is RUNE, was exploited on May 15th as revealed through ZachXBT's Telegram channel. According to reports from AMBCrypto, the cross-chain decentralized finance protocol lost more than $10.7 million worth of crypto tokens across multiple networks. The exploit affected Bitcoin [BTC], Ethereum [ETH], BNB Smart Chain [BSC], and Base Chain, with the total amount potentially rising as investigators continue tracking the hacker. On-chain investigator ZachXBT reported the incident, citing addresses linked to the theft, while analytics firm PeckShield confirmed the hack and provided detailed estimates of the stolen assets. CoinDesk reports that security researchers and on-chain investigation firms flagged a series of suspicious withdrawals spanning multiple networks, with the compromised funds associated with publicly observable wallet addresses on supported networks.
The exploit involved more than 36.75 BTC worth over $3 million and $7 million in assets across BNB Chain, Ethereum, and Base networks, as reported by PeckShield. Additional tokens stolen included USDT, USDC, WBTC, DAI, THOR, LUSD, XRUNE, GUSD, AAVE, Chainlink [LINK], and FOX. The hacker then swapped all tokens to ETH and transferred them to a single wallet, indicating that cross-chain bridges remained the most vulnerable link in decentralized finance security. Most of the stolen funds are currently concentrated in two specific addresses, according to PeckShield analysis. In a May 15, 2026 post, PeckShield wrote: '@THORChain has been compromised, with approximately $10 million in cryptocurrency stolen, including 36.75 $BTC ($3 million) and assets worth approximately $7 million on #BNBChain, #Ethereum, and #Solana.'
In response to the exploit, the protocol paused all trading activities and executed a global emergency halt across the network, according to AMBCrypto. The hack put the entire blockchain ecosystem under pressure given its interconnected nature. The RUNE token reacted with a drop of about 10% following the hack, trading near $0.53 at the time of writing. The decline led to losing the rising support trendline that had been holding price since April 19th, as the hack curtailed the token's uptrend as selling pressure followed the underlying asset as traders lost trust in its security. CoinDesk reports that THORChain's trading pause appears aimed at limiting further liquidity drain and reducing the risk of follow-on attacks across connected liquidity pools. The emergency halt gave the team time to review the reported issue and allowed developers and node operators to review wallets and transactions, though it affected users who needed access to trading.
As a key piece of cross-chain DeFi infrastructure, the disruption could ripple through related ecosystems, including wallets, aggregators and liquidity providers that rely on the protocol. The incident lands amid sustained pressure on DeFi security, with recent months marked by exploit campaigns, bridge breaches, governance weaknesses and malware targeting user wallets. Researchers continue to warn that the combination of complex smart contracts, multiple consensus systems, bridging infrastructure and liquidity management creates one of crypto's most exposed attack surfaces. The multi-chain nature of the attack across Bitcoin, Ethereum, BNB Smart Chain, and Base networks suggests either a vulnerability in THORChain's core routing logic or a coordinated exploit of a shared component across its chain integrations. Until THORChain releases an official post-incident investigation and security assessment, users with funds connected to THORChain-integrated wallets, routers or related tooling are advised to act cautiously, with common recommendations including avoiding new activity in THORChain liquidity pools and revoking unneeded wallet approvals.
