TheBlock
THORChain paused trading after blockchain security researchers flagged a suspected exploit draining more than $10 million across Bitcoin, Ethereum, BNB Smart Chain, and Base. On-chain investigators ZachXBT and PeckShield posted parallel estimates of the loss figure within hours of the activity surfacing.
Why it matters
THORChain is a cross-chain liquidity protocol sitting on top of the assets named in the exploit, which means a single attacker can route funds across four of the largest networks in one continuous path. That structural feature is the same property that makes it useful — and the same property that makes a successful exploit expensive when it lands.
Market impact
The incident marks the latest in a recurring series of security events for the protocol, which has now been through several similar pauses over the past two years. The trading halt is the standard containment step while validators trace the routing path and freeze inbound swaps; trading typically resumes after a coordinated upgrade or address block-list rather than a full post-mortem. Watch the post-mortem for the exact entry vector — the cross-chain routing layer is where prior THORChain incidents have repeatedly surfaced, and a confirmed repeat there would reset the protocol's institutional credibility.
Frequently asked questions
-
What happened to THORChain?
THORChain paused trading after on-chain investigators ZachXBT and PeckShield flagged a suspected exploit draining more than $10 million across Bitcoin, Ethereum, BNB Smart Chain, and Base.
-
How much was lost in the THORChain exploit?
ZachXBT and PeckShield estimated losses at over $10 million. The funds were routed across four chains in a single continuous path, consistent with THORChain's cross-chain liquidity design.
-
Which networks were affected by the THORChain exploit?
The suspected drain spanned Bitcoin, Ethereum, BNB Smart Chain, and Base — four of the largest networks THORChain routes liquidity between.
-
Is THORChain safe to use right now?
Trading is paused while validators trace the routing path and block-list compromised addresses. Trading typically resumes after a coordinated upgrade or address block-list, not after a full post-mortem.
-
How many times has THORChain been exploited?
This incident marks the latest in a recurring series of security events for the protocol over the past two years, including several prior trading pauses tied to cross-chain routing-layer issues.
CoinDesk
Crypto News
WuBlockchain
Lookonchain