THORChain, the decentralized cross-chain liquidity protocol, suspended all trading and signing operations Friday after an attacker drained approximately $10.8 million across four blockchain networks in a single exploit. The breach affected deployments on Bitcoin, Ethereum, Binance Smart Chain (BSC), and Base, sending the protocol's native RUNE token down roughly 12% as news spread through crypto markets.

Market Context

The attack underscores persistent security vulnerabilities in cross-chain infrastructure, an area that has become a primary target for malicious actors. According to Chainalysis data cited in reporting, bridge-related exploits have accounted for more than $2.8 billion in cumulative theft since 2021, making cross-chain bridges the most exploited category in decentralized finance (DeFi). THORChain's halt comes during a period of heightened scrutiny for multi-chain protocols following several high-profile bridge compromises over the past few years.

Analysis

THORChain operates as a decentralized network enabling users to swap native assets across different blockchains without relying on wrapped tokens or centralized intermediaries. The protocol's Mimir governance module automatically triggered trading halt and signing halt parameters in response to the exploit, according to on-chain data from investigator ZachXBT. The node pause persisted for approximately 12 hours and 42 minutes beginning at block 26,190,429 before operations resumed. The attacker has not yet been identified, and THORChain has not published a post-mortem explaining the specific attack vector—a gap that leaves the broader DeFi community without clarity on how the exploit succeeded or whether similar vulnerabilities exist in other protocols using comparable architecture.

Key Numbers

- Approximately $10.8 million was drained across Bitcoin, Ethereum, BSC, and Base deployments

- RUNE token dropped roughly 12% following news of the exploit

- Attacker wallets hold approximately 3,443 ETH ($7.77 million) per Arkham Intelligence

- Attacker wallets contain 36.85 BTC ($2.97 million) based on current prices

- Additional holdings include 96.6 BNB (approximately $66,000)

- Bridge-related exploits have totaled more than $2.8 billion since 2021 according to Chainalysis data

What to Watch

Market participants should monitor for THORChain's official post-mortem report, which will be critical in determining whether the exploit vector represents a systemic risk to other cross-chain protocols or was specific to this implementation. The protocol's recovery timeline and any governance proposals regarding compensation for affected users will also be key indicators of community confidence. Traders holding RUNE positions should watch for further updates on security audits and whether the team implements new safeguards before resuming full operations.