After blockchain investigator ZachXBT reported a potential $10 million exploit, decentralized liquidity protocol THORChain halted trading. There was a global node pause that lasted until block 26191149, or around 12 hours and 42 minutes, according to a THORChain alerts Telegram channel. During this time, all signing and trade came to a standstill.
Just after ZachXBT warned that Bitcoin, Ethereum, BNB Chain, and Base were all vulnerable to protocol exploits, the services were temporarily suspended. Several smaller transactions occurred in the thirty minutes before 10:11 am UTC, transferring $10.8 million from a wallet that Arkham identified as the THORChain exploiter.
Rising DeFi Exploits
The latest incident further heightens security concerns surrounding decentralized finance (DeFi) protocols. In April, hackers stole over $634 million, the highest monthly sum since February 2025, when the Bybit exchange was hacked for a record-breaking $1.4 billion, according to DefiLlama data.
THORChain notifications revealed that trade and signing have been suspended after ZachXBT and PeckShield detected suspicious behavior. CMC data shows that THORChain’s RUNE token was trading at $0.50, a 15.45% drop from its value after the alleged exploit.
Token prices have fallen 73% in the last year, and the most recent drop has only made matters worse. Though it is not a cryptocurrency mixer like Tornado Cash, THORChain has been exploited by bad actors to trade stolen cash on many occasions due to its status as a non-custodial cross-chain protocol.
The perpetrator of the $293 million Kelp DAO breach swapped 75,700 Ether (ETH) using THORChain in April, earning the protocol about $910,000.
Bybit co-founder and CEO Ben Zhou said that hackers transferred $1.2 billion, or almost half of the $1.4 billion stolen in the breach, from Ether to Bitcoin using THORChain.