Bitcoin · Ethereum · The Block
THORChain pauses trading as security researchers flag suspected $10 million multi-chain exploit
Compiled by KHAO Editorial — aggregated from 4 sources. See llms.txt for citation guidance.
✓ KHAO Verified
THORChain paused trading after blockchain security researchers ZachXBT and PeckShield flagged a suspected exploit spanning Bitcoin, Ethereum, BNB Smart Chain and Base, with estimated losses of more than $10 million.
Key facts
- In September 2025, THORSwap issued a bounty following a roughly $1.2 million exploit of THORChain founder John-Paul Thorbjornsen's personal wallet, which ZachXBT linked to North Korean hackers
- RUNE fell as much as 11% on the news, trading around $0.52 at the time of publication, according to CoinGecko data
- One of the most recent cases occurred when funds from the Kelp DAO hack were moved from ETH to BTC via THORChain, spiking its daily volume to $394 million, as The Block reported
- THORChain paused trading after blockchain security researchers ZachXBT and PeckShield flagged a suspected exploit spanning Bitcoin, Ethereum, BNB Smart Chain and Base, with estimated losses of more
Summary
ZachXBT and PeckShield both identified two alleged theft addresses on the Bitcoin network and EVM-compatible chains. RUNE fell as much as 11% on the news, trading around $0.52 at the time of publication, according to CoinGecko data. The incident adds to a pattern of previous security and operational disruptions involving the cross-chain liquidity protocol. THORChain previously suspended its ThorFi lending operations in January 2025 amid insolvency allegations and implemented a 90-day restructuring through validators.