ThorChain Hit by $10.8 Million Exploit — RUNE Token Crashes 12% as Protocol Halts Trading

Cross-chain liquidity protocol ThorChain halted all trading and signing on Friday May 15, 2026, after an attacker successfully drained approximately $10.8 million from the protocol across multiple chains including Bitcoin, Ethereum, Binance Smart Chain, and Base. The RUNE token fell sharply on the news, dropping 12% within minutes of the announcement as traders rushed to exit positions.

ThorChain is one of the most widely used cross-chain swap protocols in decentralized finance, allowing users to swap native assets across different blockchains without wrapping them. Its architecture, while innovative, has historically been a target for sophisticated attackers due to the complexity of managing liquidity across multiple chains simultaneously.

The protocol's team confirmed the exploit via social media and said it had paused all trading and signing functionality as a precautionary measure while the attack vector was being investigated. This kind of immediate halt is standard practice for DeFi protocols following an exploit — it limits further damage by preventing the attacker from draining additional liquidity while the vulnerability is identified and patched.

The $10.8 million loss is significant but not catastrophic relative to ThorChain's total value locked, which has consistently ranked among the top cross-chain protocols in DeFi. However, the timing is particularly damaging. The broader crypto market was already under pressure on May 15 as Bitcoin gave back some of its CLARITY Act-driven gains amid rising oil prices and repriced Federal Reserve rate expectations. A high-profile exploit adds negative sentiment at an already fragile moment for risk assets.

This is not ThorChain's first security incident. The protocol suffered multiple exploits in 2021 totaling over $13 million, each of which required emergency halts and significant recovery efforts from the team and community. Despite those setbacks, ThorChain rebuilt and grew its liquidity base substantially over the following years. Whether this latest incident follows a similar recovery trajectory will depend on the severity of the vulnerability and the speed of the team's response.

For the broader DeFi ecosystem, the ThorChain exploit is a reminder that cross-chain infrastructure remains one of the most technically challenging and security-sensitive areas of decentralized finance. Bridges and cross-chain protocols have collectively lost billions of dollars to exploits over the past four years, making security audits and real-time monitoring essential for any protocol handling multi-chain liquidity.

Investors holding RUNE should monitor official ThorChain communications closely for updates on the exploit, the recovery plan, and the timeline for resuming normal operations.

This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.