THORChain Exploit Hits Four Chains; $10M Stolen, Trading Paused

On Friday, onchain investigator ZachXBT posted on Telegram that THORChain was likely exploited across at least four networks — Bitcoin, Ethereum, BNB Chain and Base — and that attackers moved more than $10 million. Following the alert, THORChain paused trading on the protocol.

The pause stops swaps and liquidity operations while developers and security teams examine transactions and contracts. THORChain is a cross-chain liquidity protocol that allows token swaps across different blockchains without routing trades through a centralized exchange.

ZachXBT flagged the affected networks and estimated the value taken, but provided no attribution to a known threat actor and no technical details about the attack vector. The initial public information did not identify specific smart contracts or wallet addresses involved in the transfers.

Onchain tracing typically follows asset flows across bridges, smart contracts and liquidity pools. Investigators monitor recipient wallets in real time to track where stolen funds move and to identify attempts to convert or launder assets through decentralized exchanges, mixing services or further cross-chain transfers.

Security teams, auditors and blockchain researchers commonly collaborate after such incidents to analyze transaction histories, smart-contract calls and wallet clusters for indicators of the exploit method. THORChain’s pause gives those teams time to inspect contract code, audit transaction logs and contain additional losses.

Public updates remain limited to the investigator’s alert and THORChain’s decision to halt trading. Additional information from THORChain and blockchain investigators may clarify which contracts were affected, how the breach occurred and whether any funds can be recovered.