THORChain (RUNE) Suffers $10M Cross-Chain Attack, Token Plunges 15% – Blockonomi

Key Takeaways

• On-chain sleuth ZachXBT identified a breach exceeding $10 million on THORChain, spanning Bitcoin, Ethereum, BSC, and Base networks
• The protocol activated emergency shutdown procedures, suspending all swap and trading operations to safeguard liquidity providers
• Identified attacker addresses contain 36.85 BTC, 3,443 ETH, and 96.6 BNB plus additional digital assets
• RUNE experienced a sharp 15% decline, sliding from $0.58 to approximately $0.50 following the breach disclosure
• RUNE derivatives open interest surged 19% within a four-hour window, indicating heightened speculative trading amid the selloff

On May 15, 2026, THORChain—a decentralized protocol facilitating cross-chain liquidity—fell victim to a security breach resulting in losses exceeding $10 million. The incident was first brought to light by renowned blockchain investigator ZachXBT, who documented suspicious fund movements across multiple blockchain networks.

The compromise affected four major networks: Bitcoin, Ethereum, BNB Smart Chain, and Base. The malicious actor extracted assets by exploiting THORChain’s router smart contracts deployed on each respective blockchain.

Blockchain analytics service Arkham Intelligence tracked down the addresses controlled by the attacker. Their analysis revealed holdings of 36.85 BTC, 3,443 ETH, and 96.6 BNB, in addition to various stablecoins including USDT, USDC, and wrapped Bitcoin (WBTC).

ZachXBT’s preliminary assessment placed the damage at over $7.4 million. Following additional blockchain forensics and transaction tracing, he revised the total upward to a minimum of $10 million.

Emergency Shutdown Procedures Activated

Following detection of the security incident, THORChain’s team initiated the protocol’s integrated emergency shutdown system. This HaltTrading function immediately suspended all trading and token swap functionality across every connected blockchain.

Despite the trading freeze, the underlying THORChain blockchain continues to operate, and native RUNE token transfers remain functional. This shutdown protocol exists specifically to prevent cascading losses while the network’s node operators investigate the breach.

Multiple blockchain security monitoring services, including PeckShieldAlert, quickly identified and flagged the suspicious wallet addresses following the public disclosure. THORChain’s validator nodes automatically entered protection mode as programmed in the protocol’s defensive architecture.

ZachXBT also criticized an unverified third-party source that republished the breach information without conducting independent verification. He noted they failed to confirm the actual loss amounts or validate which blockchains were compromised.

Token Value Experiences Sharp Decline

Within minutes of ZachXBT’s public disclosure gaining traction, RUNE witnessed a precipitous 15% decline. The digital asset tumbled from above $0.58 to approximately $0.50 before finding temporary support.

As of this report, RUNE was changing hands around $0.52. The token’s 24-hour trading range extended from $0.502 to $0.597.

Spot market activity intensified dramatically, with trading volume increasing nearly 140% over 24 hours as holders liquidated positions. Interestingly, futures markets displayed contradictory behavior.

According to CoinGlass metrics, aggregate THORChain futures open interest expanded by over 6% to reach $24.80 million in just 60 minutes. RUNE futures contracts saw open interest balloon by 19% across four hours, with major exchanges Binance and Bybit reporting increases of approximately 17% and 19% respectively.

RUNE’s total market capitalization hovered near $204.88 million prior to exchanges fully reflecting the price correction. The asset has declined more than 70% from its peak over the trailing twelve months.

This incident marks the second time in 2026 that THORChain has been associated with major security events. In April, approximately $175 million in ETH from the massive $290 million Kelp DAO exploit was laundered through THORChain as attackers dispersed funds across numerous wallet addresses.

That previous incident highlighted ongoing challenges with recovering stolen cryptocurrency, particularly when illicit funds traverse multiple blockchain ecosystems, making forensic tracking significantly more complex.