TLDR
Cross-chain liquidity protocol THORChain (RUNE) has paused trading after a suspected multi-chain exploit siphoned over 10 million dollars across several major networks.
- Blockchain sleuths report a coordinated attack draining about 10 to 11 million dollars from THORChain across Bitcoin, Ethereum, BNB Chain, and Base, with trading halted to contain damage.
- Early analysis points to a vault churn address poisoning attack that abused THORChains cross-chain vault rotation process, highlighting structural risks in complex bridge-style DeFi systems.
- RUNE has dropped double digits, and users are being urged to avoid interacting with the protocol and monitor official updates until a full post-mortem and recovery plan are published.
Deep Dive
1. What Happened And How Big It Is
On-chain investigator ZachXBT and security firm PeckShield flagged a suspected THORChain exploit affecting Bitcoin, Ethereum, BNB Chain, and Base, prompting THORChain to pause all trading and signing to prevent further losses. Trading was halted for a defined block window after the alarm was raised, as detailed in a trading pause notice.
Multiple analytics firms and media reports estimate losses at roughly 10 to 11 million dollars, with one wallet labeled as the exploiter holding around 10.8 million dollars in consolidated funds. Stolen assets reportedly include BTC, ETH, BNB, stablecoins, and other tokens spread across the affected chains.
This is a material protocol-level hit, not just an illiquid pool bug, and it directly impacts users and liquidity providers who were routed through THORChains cross-chain vaults.
2. How The Exploit Worked And Why Cross-Chain Is Exposed
A detailed breakdown describes the incident as a vault churn address poisoning attack, where attackers injected malicious addresses during THORChains normal vault rotation process so that funds were redirected in a routine migration across chains. That mechanism is outlined in a technical post-incident report.
Because THORChain coordinates assets across multiple networks using threshold-signature vaults, any flaw in churn logic, address validation, or signing flows can have multi-chain consequences. This complexity is typical of cross-chain bridges and DEXs and is one reason they are among the most frequently and severely targeted parts of DeFi.
3. Market Impact And What To Watch Next
Following the exploit, RUNE dropped roughly 10 to 15 percent intraday, with reports noting that it erased tens of millions of dollars in market capitalization and is down sharply over the past year as well, as seen in a price reaction recap. Confidence is understandably weaker until the team demonstrates that the root cause is fixed.
Key next milestones are:
- A full THORChain post-mortem explaining the bug, scope of losses, and any plan to compensate affected users or LPs.
- Concrete hardening steps for vault churn, key management, and monitoring.
- Clear criteria and timing for safely resuming trading across supported chains.
For now, the risk is asymmetric toward further bad news until there is a verified fix, so the practical focus is on protocol recovery steps, not short-term yield or volume.
Conclusion
A sophisticated multi-chain exploit against THORChain shows how a single weakness in cross-chain vault processes can cascade into eight-figure losses and double-digit token drawdowns. Until the team delivers a transparent post-mortem and hardened vault architecture, the main lens for THORChain is security and recovery, not growth, and users should treat cross-chain infrastructure risk as a first-class factor when evaluating DeFi exposure.
CoinsKid.Com