Thorchain Exploited? Trading Paused Amid Risk of Enormous Attack

Cross-chain DeFi protocol THORChain has suspended trading, following what appears to be a significant multi-chain exploit that may have depleted over $10 million in cryptocurrency assets. Suspicious withdrawals involving Bitcoin, Ethereum, BNB Chain, and Base-linked assets have been reported by security researchers and on-chain investigators such as PeckShield.

Early tracking data indicates that the attackers allegedly took about 36.75 BTC, or about $3 million, along with an additional $7 million in assets that were bridged across several chains. Both Bitcoin and Ethereum-compatible networks’ publicly known wallet addresses were linked to the stolen funds.

#PeckShieldAlert @THORChain has been exploited for ~$10M worth of crypto, including 36.75 $BTC ($3M) and ~$7M worth of assets from #BNBChain, #Ethereum, and #Base.

The stolen funds mainly sit in:
bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37… pic.twitter.com/mhWIWueVPK

— PeckShieldAlert (@PeckShieldAlert) May 15, 2026

Following the incident, THORChain stopped trading, probably to avoid further liquidity drains or cascading exploits across linked pools. Because THORChain serves as essential infrastructure for decentralized cross-chain swaps, disruptions may affect all of the ecosystems, wallets, aggregators, and liquidity suppliers.

DeFi security is in trouble

DeFi security is already experiencing hardship. Exploits, bridge attacks, governance breaches, and wallet-draining malware campaigns have plagued the industry in recent months. When a layer fails, interconnected DeFi systems can quickly spread contagion, as demonstrated by recent attacks on major protocols.