THORChain Suffers $10 Million Multi-Chain Exploit; RUNE Plunges 15%

TLDR

• Blockchain investigator ZachXBT identified an exploit on THORChain exceeding $10 million, impacting Bitcoin, Ethereum, BSC, and Base chains.
• THORChain initiated an emergency halt, suspending all trading and swaps to safeguard liquidity providers.
• The attacker’s wallets contain 36.85 BTC, 3,443 ETH, and 96.6 BNB, among other digital assets.
• Following the alert, RUNE experienced a drop of up to 15%, decreasing from $0.58 to approximately $0.50.
• Despite the price decline, futures open interest for RUNE surged by 19% within four hours, indicating significant derivatives market activity.

(SeaPRwire) –   THORChain, a decentralized protocol facilitating cross-chain liquidity, was subjected to an exploit valued at over $10 million on May 15, 2026. The attack was initially brought to light by blockchain investigator ZachXBT, who reported unauthorized fund movements across four prominent blockchain networks.

The affected networks include Bitcoin, Ethereum, BNB Smart Chain, and Base. The perpetrator siphoned funds by exploiting THORChain’s router contracts on each respective network.

The attacker’s digital wallets were identified by the analytics platform Arkham. These wallets were found to hold 36.85 BTC, 3,443 ETH, and 96.6 BNB, in addition to stablecoins like USDT and USDC, and Wrapped Bitcoin (WBTC).

Initially, ZachXBT estimated the losses to be more than $7.4 million. However, after a more thorough review of on-chain data, this figure was revised to at least $10 million.

Can tell because they did not check the numbers themselves / chains listed.

I finished accounting again now and it looks to be $10M+ stolen at least.

— ZachXBT (@zachxbt) May 15, 2026

THORChain Triggers Emergency Halt

In response to the detected exploit, THORChain activated its integrated emergency halt mechanism. This feature, known as HaltTrading, effectively paused all trading and swap operations across the connected blockchain networks.

During this halt, the THORChain blockchain itself and native RUNE transactions remain operational. The purpose of this pause is to mitigate further losses while node operators investigate the incident.

Security firms, including PeckShieldAlert, identified the attacker’s wallets shortly after the exploit was publicly disclosed. The protocol’s nodes automatically suspended operations as part of its built-in security response system.

ZachXBT also pointed out a third-party account that disseminated the alert without independently verifying the reported figures, noting that they had not checked the numbers themselves or confirmed the specific chains involved.

RUNE Price Falls Sharply

The price of RUNE experienced a sharp decline of approximately 15% within minutes of ZachXBT’s alert circulating online. The token’s value dropped from above $0.58 to near $0.50 before showing signs of stabilization.

At the time of this report, RUNE was trading at approximately $0.52. Its 24-hour trading range spanned from $0.502 to $0.597.

Trading volume saw an increase of nearly 140% within a 24-hour period as investors sold off their holdings amidst the price drop. In contrast to the spot market sell-off, derivatives markets exhibited different behavior.

Data from CoinGlass indicated that THORChain futures open interest rose by over 6% to $24.80 million within an hour. RUNE futures open interest climbed 19% over a four-hour period, with significant increases observed on Binance and Bybit, around 17% and 19% respectively.

Prior to the full impact of the price drop being reflected across tracking platforms, RUNE’s market capitalization was close to $204.88 million. The token has experienced a decline of over 70% in the past year.

This incident is not the first time THORChain has faced scrutiny in 2026. In April, funds from the Kelp DAO exploit, which involved approximately $290 million, were routed through THORChain as attackers moved around $175 million in ETH across newly created wallets.

That earlier event raised concerns regarding cross-chain asset recovery, as stolen assets become more challenging to trace when they are moved across multiple blockchain networks.