Bitcoin · Ethereum · Cointelegraph
THORChain pauses trading after suspected $10 million exploit
Compiled by KHAO Editorial — aggregated from 4 sources. See llms.txt for citation guidance.
✓ KHAO Verified
THORChain paused trading after ZachXBT flagged a suspected $10 million exploit spanning Bitcoin, Ethereum, BNB Chain and Base.
Key facts
- Earlier in April, the attacker behind the $293 million Kelp DAO exploit swapped 75,700 Ether (ETH) through THORChain, generating about $910,000 in revenue for the protocol
- Most the $1.4 billion stolen during the Bybit hack, or about $1.2 billion, was also moved through THORChain by hackers, who swapped it from Ether to Bitcoin, according to Bybit co-founder and CEO Ben
- A wallet labeled by Arkham as the THORChain exploiter showed $10.8 million in holdings, transferred across several smaller transactions in the 30 minutes before 10:11 am UTC
- THORChain’s RUNE token fell by around 13% following the suspected exploit and traded near $0.51 at the time of writing, according to CoinGecko data
Summary
Decentralized liquidity protocol THORChain halted trading after blockchain investigator ZachXBT flagged a suspected exploit of more than $10 million. A THORChain alerts Telegram channel showed all trading and signing halted, with a global node pause extended until block 26191149, or roughly 12 hours and 42 minutes. A wallet labeled by Arkham as the THORChain exploiter showed $10.8 million in holdings, transferred across several smaller transactions in the 30 minutes before 10:11 am UTC. The suspected exploit adds to the mounting security concerns around decentralized finance (DeFi) protocols, after hackers stole over $634 million during April, marking the highest monthly sum since the $1.46 billion in February 2025, when hackers staged the record $1.4 billion hack on Bybit exchange, DefiLlama data shows.