THORChain restarts trading after $10.7M May exploit

THORChain resumed trading on Tuesday after more than five weeks offline following an exploit in mid-May that drained $10.7 million from one of its six Asgard vaults.

The network paused trading on May 15 after suspicious activity was detected affecting assets on Bitcoin, Ethereum, BNB Chain and Base. The team ran verifications on each vault and checked all keyshares before restoring on-chain activity.

Node operators, protocol developers and the Maya Protocol team performed node-level checks and helped keep the network stable during the restart. The protocol wrote on its official X account: “Signing, churning, liquidity provider actions, and swaps are all live again.”

Native Monero swaps completed end-to-end testing and a live launch is planned. Support for Zcash is scheduled next. Planned upgrades include dynamic fees and deeper liquidity provisioning intended to improve market function and fee responsiveness.

The protocol has not reported any recovery of the $10.7 million. Investigations into the incident are ongoing.

Market response was muted after trading resumed; the RUNE token showed little immediate movement. THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps across blockchains without wrapping or routing through a centralized intermediary.

The compromised vault was one of six Asgard vaults; the other five were reported unaffected. The outage lasted more than five weeks while the project completed security and key management checks before bringing services back online.