Cross-chain protocol THORChain suspended all trading Friday morning following suspected exploit activity flagged by security researchers. Blockchain investigator ZachXBT and firm PeckShield identified two addresses linked to alleged losses exceeding $10 million across Bitcoin, Ethereum, BNB Smart Chain, and Base networks. The protocol halted operations to investigate the potential security breach while its native token RUNE fell 10%.
THORChain halted trading operations Friday morning after blockchain security researchers identified a suspected exploit. Blockchain researcher ZachXBT and security firm PeckShield traced the suspected breach to two main addresses.
The addresses are one on Bitcoin and another on EVM-compatible chains including Ethereum, BNB Smart Chain, and Base. The researchers’ analysis prompted THORChain’s immediate defensive response.
The protocol’s team has not released technical details about the alleged vulnerability. THORChain’s native token RUNE is down 10% on the day to trade at $0.5229.
The suspected exploit occurred during a period of elevated activity on THORChain. The protocol processed $394 million in daily volume when hackers allegedly used it to move stolen funds from the KelpDAO breach.
The protocol suspended its ThorFi lending operations in January 2025 amid insolvency allegations. It implemented a 90-day restructuring to address $200 million in defaulted obligations.
Last September, THORSwap issued a bounty after hackers drained $1.2 million from THORChain founder John-Paul Thorbjornsen’s personal wallet. ZachXBT later attributed the attack to North Korean hackers.
Cross-chain protocols continue facing sophisticated attacks as hackers exploit complex bridging mechanisms. DeFi platform TrustedVolumes lost $6.7 million earlier this month.
North Korean hackers stole $2.1 billion in cryptocurrency during 2025. This represented 60% of all crypto theft losses according to security firm CertiK.
