The cross-chain protocol THORChain has been breached: hackers have stolen over $10 million in crypto assets across the Bitcoin, Ethereum, BNB Chain, and Base networks.
On-chain analyst ZachXBT was the first to report the attack, initially estimating the damage at $7.4 million.
According to PeckShield, the stolen assets include 36.75 BTC worth about $3 million and approximately $7 million in assets from BNB Chain, Ethereum, and Base. The majority of the funds are concentrated in two addresses.
#PeckShieldAlert @THORChain has been exploited for ~$10M worth of crypto, including 36.75 $BTC ($3M) and ~$7M worth of assets from #BNBChain, #Ethereum, and #Base.
The stolen funds mainly sit in:
bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37… pic.twitter.com/mhWIWueVPK— PeckShieldAlert (@PeckShieldAlert) May 15, 2026
Following the attack, the RUNE token plummeted by 12% to $0.508.
Analysts at Lookonchain confirmed ZachXBT’s assessment, noting that the total damage exceeded $10 million.
According to @zachxbt, #THORChain appears to have been exploited across multiple chains, including #Bitcoin, #Ethereum, #BSC, and #Base, with stolen funds already exceeding $10M.https://t.co/Pqj8JwXdAj pic.twitter.com/lYBjuhnKB5
— Lookonchain (@lookonchain) May 15, 2026
The developers of THORChain have not officially confirmed the breach but have temporarily disabled certain network functions for verification.
This is not the first incident in the project’s history. In January 2025, the protocol froze the ThorFi lending platform amid insolvency rumors. The protocol later resolved a $200 million debt issue through new token issuance and restructuring.
In September, hackers breached the personal wallet of THORChain’s founder. According to ZachXBT, North Korean groups were involved in the $1.2 million attack.
THORChain is frequently used for laundering stolen funds: cross-chain exchanges complicate transaction tracking.
Recently, assets stolen from Kelp were extracted through the protocol. Amid these operations, daily trading volume reached $394 million.
In April, Kelp was attacked, allegedly by the Lazarus Group. This breach was the largest in the DeFi sector since the beginning of the year.