Cyber Thieves Inflict $10 Million Blow on THORChain, Sending RUNE Prices Into Tailspin

A devastating security breach struck THORChain, a protocol designed to facilitate cross-chain liquidity, on May 15, 2026, resulting in staggering losses of over $10 million. The vulnerability was first exposed by blockchain investigator ZachXBT, who identified suspicious transactions spanning multiple blockchain networks, including Bitcoin, Ethereum, BNB Smart Chain, and Base. By exploiting router smart contracts on each of these platforms, the attacker was able to extract substantial assets.

Blockchain analytics firm Arkham Intelligence successfully tracked down the attacker's addresses, revealing a trove of cryptocurrencies, including 36.85 BTC, 3,443 ETH, and 96.6 BNB, in addition to various stablecoins such as USDT, USDC, and WBTC. Initially, ZachXBT estimated the damage at over $7.4 million, but following a more in-depth analysis, he revised the figure upward to a minimum of $10 million.

As news of the breach spread, THORChain's team swiftly activated the protocol's emergency shutdown system, halting all trading and token swap functionality across the affected blockchains. Although trading was suspended, the underlying blockchain and native RUNE token transfers continued to function, allowing node operators to investigate the breach without exacerbating potential losses.

The security incident triggered a swift response from multiple blockchain security monitoring services, including PeckShieldAlert, which quickly identified and flagged the suspicious wallet addresses. THORChain's validator nodes automatically entered protection mode, as designed, to mitigate further damage.

ZachXBT also called out an unverified third-party source for republishing the breach information without verifying the details, including the extent of the losses and the specific blockchains compromised. The public disclosure of the breach led to a sharp 15% decline in the value of RUNE, from above $0.58 to around $0.50, before stabilizing at approximately $0.52.

The incident sparked a surge in spot market activity, with trading volume increasing by nearly 140% over 24 hours as holders rushed to liquidate their positions. In contrast, futures markets exhibited contradictory behavior, with THORChain futures open interest expanding by over 6% to reach $24.80 million within 60 minutes, according to CoinGlass metrics.

This security breach marks the second major incident affecting THORChain in 2026, following the laundering of approximately $175 million in ETH from the Kelp DAO exploit through the protocol in April. The ongoing challenges in recovering stolen cryptocurrency highlight the complexities of tracking illicit funds across multiple blockchain ecosystems. As of the latest report, RUNE's total market capitalization stood near $204.88 million, having declined by over 70% from its peak in the past 12 months.