THORChain pauses trading after suspected $10M exploit

THORChain paused its on-chain trading functionality after security researchers flagged a suspected exploit that appears to have moved over $10 million across Bitcoin, Ethereum, BNB Smart Chain and Base. The pause affects swaps that move native assets directly between blockchains.

Researchers identified two alleged theft addresses on the Bitcoin network and on EVM-compatible chains and described the incident as likely but not yet confirmed. The protocol halted trading while validators and investigators trace the transfers and assess their scope.

Initial on-chain analysis indicates the transfers used THORChain’s cross-chain liquidity mechanisms to shift assets between UTXO and smart-contract networks. That routing across different technical environments means tracking flows requires work on both Bitcoin-style ledgers and EVM chains.

Investigators and on-chain analysts are reconstructing transaction histories to follow funds and search for reused addresses or links to custodial services. The presence of alleged theft addresses on multiple networks complicates potential recovery because custody and tracing tools differ by chain.

THORChain’s validators have previously paused or limited operations in response to risks. In January 2025 the protocol suspended ThorFi lending operations during a 90-day restructuring overseen by validators that converted roughly $200 million in defaulted obligations into a new equity-style token.

In September 2025 a separate incident resulted in about $1.2 million being removed from the personal wallet of THORChain’s founder; analysts linked that theft to North Korean–linked hacking groups. THORChain also has been used to move proceeds from unrelated breaches between chains, including a recent case in which funds were routed from Ethereum to Bitcoin through the protocol, briefly boosting daily volume.

THORChain’s status page and validator communications have not yet posted a full post-mortem. Users with positions in the protocol are being asked to follow official validator channels and to avoid interacting with addresses tied to the flagged transactions.

Investigations are ongoing. Security teams, validators and independent analysts continue to analyze on-chain data and coordinate responses. Further technical details and official statements are expected once initial forensic work is complete.