In a shocking turn of events, blockchain tracking firm Arkham Intelligence has identified a series of suspicious wallets dubbed the “THORChain Exploiter,” with one wallet linked to Bitcoin holding nearly 36.85 BTC — valued at roughly $3 million. Another wallet associated with Ethereum contains around 216 ETH. These funds remain visible on-chain and have already been flagged by security researchers.
Initial Discovery
On-chain investigator ZachXBT was the first to spot the exploit, reporting unusual transactions related to THORChain’s router infrastructure. He noted that attackers had moved approximately $7.2 million in assets, including USDT, USDC, and wrapped Bitcoin, across various blockchains before converting them into ETH.
While ZachXBT initially estimated losses to be over $7.4 million, that figure has since been revised upwards, with the total amount stolen now believed to exceed $10 million, as he confirmed in a recent update.
Can tell because they did not check the numbers themselves / chains listed.
I finished accounting again now and it looks to be $10M+ stolen at least.
— ZachXBT (@zachxbt) May 15, 2026
THORChain operates as a cross-chain trading protocol, allowing users to swap cryptocurrencies across different blockchains without relying on centralized exchanges. However, this very design, which connects multiple networks simultaneously, has made it vulnerable to such attacks, with this incident affecting Bitcoin, Ethereum, BNB Chain, and Base.
Security firm PeckShield has corroborated the breach, estimating that attackers have extracted around 36.75 BTC alongside roughly $7 million more from the Ethereum, BNB Chain, and Base ecosystems.
Market Reactions and Official Silence
Following the news of the exploit, RUNE, THORChain’s native token, plummeted nearly 14%, slipping towards the $0.50 mark as traders rushed to mitigate their exposure. The rapid price drop has been met with an equally swift silence from the official THORChain team.
As of now, THORChain has not issued any public statements detailing the scope of the exploit or the measures being implemented to address the situation. This lack of communication has only heightened anxiety within the market. In previous incidents, the protocol managed to navigate security crises by utilizing treasury reserves and recovery mechanisms. However, the uncertainty surrounding this latest breach leaves many questioning the feasibility of a similar recovery.
A Frightening Trend in DeFi
Cross-chain infrastructures have repeatedly been at the center of significant losses in the decentralized finance sector. The bridges and routing systems that facilitate connections between different blockchains rely on intricate code — and as the complexity increases, so does the risk of vulnerabilities. The THORChain exploit exemplifies this troubling trend.
The stolen assets remain in the identified wallets for the time being, but whether they will continue to sit there is an open question.
Featured image from Unsplash, chart from TradingView
