Cross chain DeFi exploit drains over $10M

TLDR

A major exploit hit THORChain (RUNE), draining roughly $1011 million from its cross-chain liquidity protocol and forcing a temporary trading halt across multiple networks.

1. THORChain was exploited across Bitcoin, Ethereum, BNB Chain, and Base, with investigators tracking about $10.7 million in stolen assets and the network put into emergency halt.
2. Most reports indicate losses came from protocol-owned vaults rather than user wallets, but RUNE dropped double digits and the incident highlights how fragile cross-chain DeFi infrastructure remains.
3. The key next steps are a full post-mortem, decisions on reopening and compensation, and closer scrutiny of cross-chain bridges and routers across the ecosystem.

Deep Dive

1. What Was Exploited

THORChain, a decentralized cross-chain liquidity protocol, suffered an exploit on 15 May 2026 that drained over $10 million across BTC, ETH, BNB Chain, and Base.

Security firms and on-chain investigators, including ZachXBT and PeckShield, traced roughly 36.75 BTC (about $3 million) plus around $7 million in other assets to attacker-controlled addresses, with THORChain halting all trading and signing for around 12 hours to contain the breach.

One detailed report states the attack targeted an Asgard vault holding protocol-owned assets, leading to losses of over $10 million in digital assets while user funds appear unaffected, and triggering an automatic network-wide emergency halt.

2. Why This Matters For DeFi

THORChain is a core piece of cross-chain infrastructure, used by wallets, aggregators, and other protocols to swap native assets between chains without centralized bridges. An exploit here is not just a single-app issue; it affects many downstream integrations.

RUNE fell roughly 1015 percent on the news, reflecting a rapid repricing of security and protocol-risk assumptions. For liquidity providers and integrators, the event underlines that protocol-owned capital and economic safety mechanisms can still be breached.

More broadly, cross-chain DeFi remains one of the most attacked areas in crypto, with recent months seeing hundreds of millions of dollars lost to bridge and router exploits, highlighting that interoperability has expanded attack surfaces faster than security practices.

3. What To Watch And How To Think About Risk

Over the coming days, the key milestones will be: a technical post-mortem explaining the attack path, any compensation or slashing decisions, and governance choices on when and how to resume trading.

For users and integrators, the practical risk lens is: how much of your DeFi stack depends on cross-chain routers and bridges, what percentage of capital sits in those paths, and whether their security models have independent audits and robust monitoring.

Confidence: high because multiple independent news outlets and on-chain investigators report consistent loss ranges, affected chains, and the trading halt details.

Conclusion

The exploit on THORChain shows that even mature cross-chain protocols can still be a single point of failure for significant amounts of capital and liquidity.

Until there is a clear, credible post-mortem and visible security hardening, cross-chain DeFi should be viewed as powerful but structurally higher risk, and monitored closely whenever large volumes flow through these systems.