What Triggered THORChain’s Trading Suspension?
THORChain paused trading after blockchain security researchers ZachXBT and PeckShield flagged a suspected exploit affecting assets across Bitcoin, Ethereum, BNB Smart Chain, and Base.
The researchers identified alleged theft addresses on both the Bitcoin network and EVM-compatible chains, estimating losses at more than $10 million. Both ZachXBT and PeckShield described the exploit as likely but not yet fully confirmed at the time of reporting.
The announcement triggered an immediate market reaction. THORChain’s native token, RUNE, fell as much as 11% following the reports, trading near $0.52 according to CoinGecko data.
The incident adds to a growing history of operational and security disruptions surrounding the cross-chain liquidity protocol.
Why Does THORChain Continue to Face Security Pressure?
THORChain operates as a cross-chain liquidity network designed to move assets between blockchains without relying on wrapped tokens or centralized intermediaries. That structure increases technical complexity and expands the potential attack surface compared with single-chain protocols.
The protocol has repeatedly appeared in investigations tied to exploit-related fund movement. In several cases, stolen assets were routed through THORChain to swap between chains, particularly from Ethereum into Bitcoin.
One recent example involved funds connected to the Kelp DAO exploit, where assets were bridged through THORChain, pushing daily protocol volume to roughly $394 million.
The latest incident follows earlier operational stress. In January 2025, THORChain suspended ThorFi lending operations amid insolvency allegations and later implemented a 90-day validator-led restructuring process.
Investor Takeaway
How Did THORChain Handle Previous Crises?
Following the ThorFi disruption, THORChain addressed a reported $200 million debt crisis by converting defaulted obligations into a new equity-style token structure. The move prevented immediate collapse but raised questions about the long-term sustainability of the protocol’s financial design.
Security incidents have also directly affected figures connected to the ecosystem. In September 2025, THORSwap announced a bounty after an exploit targeting THORChain founder John-Paul Thorbjornsen’s personal wallet resulted in losses of roughly $1.2 million. ZachXBT later linked the activity to North Korean hackers.
The repeated appearance of the protocol in exploit investigations has increasingly tied THORChain’s public profile to laundering concerns and post-hack fund movement rather than purely decentralized liquidity infrastructure.
Investor Takeaway
What Are the Broader Implications for Cross-Chain DeFi?
The suspected exploit highlights ongoing challenges facing cross-chain decentralized finance systems. Protocols designed to move assets across networks often combine liquidity management, bridging infrastructure, and automated execution layers, creating multiple points of failure.
Regulators and compliance firms have also increased scrutiny on cross-chain protocols because of their repeated use in laundering stolen funds. This has placed additional pressure on projects operating decentralized swap infrastructure without centralized controls.
For the broader market, the incident reinforces how quickly confidence can deteriorate when trading pauses and exploit allegations emerge simultaneously. Until the scale and mechanics of the incident are fully confirmed, attention is likely to remain focused on fund flows, protocol solvency, and the effectiveness of THORChain’s response measures.