{"id":97124,"date":"2026-05-15T13:45:56","date_gmt":"2026-05-15T10:45:56","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=97124"},"modified":"2026-05-15T13:50:15","modified_gmt":"2026-05-15T10:50:15","slug":"hackers-extract-10-million-from-thorchain","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/hackers-extract-10-million-from-thorchain\/","title":{"rendered":"Hackers Extract $10 Million from THORChain"},"content":{"rendered":"<p><a href=\"https:\/\/forklog.com\/en\/news\/what-are-cross-chain-bridges\">The cross-chain<\/a> protocol THORChain has been breached: hackers have stolen over $10 million in crypto assets across the Bitcoin, Ethereum, BNB Chain, and <a href=\"https:\/\/forklog.com\/en\/news\/what-is-base-coinbases-l2\">Base<\/a> networks.<\/p>\n<p>On-chain analyst ZachXBT was the first to report the attack, initially estimating the damage at $7.4 million.<\/p>\n<p><script async src=\"https:\/\/telegram.org\/js\/telegram-widget.js?23\" data-telegram-post=\"investigations\/319\" data-width=\"100%\"><\/script><\/p>\n<p>According to PeckShield, the stolen assets include 36.75 BTC worth about $3 million and approximately $7 million in assets from BNB Chain, Ethereum, and Base. The majority of the funds are concentrated in two addresses.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> <a href=\"https:\/\/twitter.com\/THORChain?ref_src=twsrc%5Etfw\">@THORChain<\/a> has been exploited for ~$10M worth of crypto, including 36.75 <a href=\"https:\/\/twitter.com\/search?q=%24BTC&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$BTC<\/a> ($3M) and ~$7M worth of assets from <a href=\"https:\/\/twitter.com\/hashtag\/BNBChain?src=hash&#038;ref_src=twsrc%5Etfw\">#BNBChain<\/a>, <a href=\"https:\/\/twitter.com\/hashtag\/Ethereum?src=hash&#038;ref_src=twsrc%5Etfw\">#Ethereum<\/a>, and <a href=\"https:\/\/twitter.com\/hashtag\/Base?src=hash&#038;ref_src=twsrc%5Etfw\">#Base<\/a>.<\/p>\n<p>The stolen funds mainly sit in:<br \/>bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37\u2026 <a href=\"https:\/\/t.co\/mhWIWueVPK\">pic.twitter.com\/mhWIWueVPK<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/2055226411125027171?ref_src=twsrc%5Etfw\">May 15, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Following the attack, the RUNE token plummeted by 12% to $0.508.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-7055d2b26283bf5e-4443161042358622.webp\" alt=\"RUNEUSDT_2026-05-15_13-24-20\" class=\"wp-image-279998\"\/><figcaption class=\"wp-element-caption\">Hourly chart of RUNE\/USDT on Binance. Source: <a href=\"https:\/\/www.tradingview.com\/chart\/?symbol=BINANCE%3ARUNEUSDT\">TradingView<\/a>.<\/figcaption><\/figure>\n<p>Analysts at Lookonchain confirmed ZachXBT&#8217;s assessment, noting that the total damage exceeded $10 million.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">According to <a href=\"https:\/\/twitter.com\/zachxbt?ref_src=twsrc%5Etfw\">@zachxbt<\/a>, <a href=\"https:\/\/twitter.com\/hashtag\/THORChain?src=hash&#038;ref_src=twsrc%5Etfw\">#THORChain<\/a> appears to have been exploited across multiple chains, including <a href=\"https:\/\/twitter.com\/hashtag\/Bitcoin?src=hash&#038;ref_src=twsrc%5Etfw\">#Bitcoin<\/a>, <a href=\"https:\/\/twitter.com\/hashtag\/Ethereum?src=hash&#038;ref_src=twsrc%5Etfw\">#Ethereum<\/a>, <a href=\"https:\/\/twitter.com\/hashtag\/BSC?src=hash&#038;ref_src=twsrc%5Etfw\">#BSC<\/a>, and <a href=\"https:\/\/twitter.com\/hashtag\/Base?src=hash&#038;ref_src=twsrc%5Etfw\">#Base<\/a>, with stolen funds already exceeding $10M.<a href=\"https:\/\/t.co\/Pqj8JwXdAj\">https:\/\/t.co\/Pqj8JwXdAj<\/a> <a href=\"https:\/\/t.co\/lYBjuhnKB5\">pic.twitter.com\/lYBjuhnKB5<\/a><\/p>\n<p>\u2014 Lookonchain (@lookonchain) <a href=\"https:\/\/twitter.com\/lookonchain\/status\/2055225837172248657?ref_src=twsrc%5Etfw\">May 15, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The developers of THORChain have not officially confirmed the breach but have temporarily disabled certain network functions for verification.<\/p>\n<p><script async src=\"https:\/\/telegram.org\/js\/telegram-widget.js?23\" data-telegram-post=\"thorchain_alert\/44623\" data-width=\"100%\"><\/script><\/p>\n<p>This is not the first incident in the project&#8217;s history. In January 2025, the protocol <a href=\"https:\/\/www.theblock.co\/post\/336782\/thorchain-thorfi-rune-restructuring\">froze<\/a> the ThorFi lending platform amid insolvency rumors. The protocol later resolved a $200 million debt issue through new token issuance and restructuring.<\/p>\n<p>In September, hackers <a href=\"https:\/\/forklog.com\/en\/news\/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft\">breached<\/a> the personal wallet of THORChain&#8217;s founder. According to ZachXBT, North Korean groups were involved in the $1.2 million attack.<\/p>\n<p>THORChain is frequently used for laundering stolen funds: cross-chain exchanges complicate transaction tracking.<\/p>\n<p>Recently, assets stolen from Kelp were <a href=\"https:\/\/forklog.com\/en\/news\/arbitrum-freezes-30766-eth-amid-probe-into-kelp-hack\">extracted<\/a> through the protocol. Amid these operations, daily trading volume reached $394 million.<\/p>\n<p>In April, Kelp <a href=\"https:\/\/forklog.com\/en\/news\/kelp-and-aave-begin-asset-recovery-after-hack\">was attacked<\/a>, allegedly by the Lazarus Group. This breach was the largest in the DeFi sector since the beginning of the year.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The cross-chain protocol THORChain has been breached: hackers have stolen over $10 million in crypto assets across the Bitcoin, Ethereum, BNB Chain, and Base networks.<\/p>\n","protected":false},"author":1,"featured_media":97125,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Hackers stole over $10 million from THORChain across multiple networks.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1750],"class_list":["post-97124","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-thorchain"],"aioseo_notices":[],"amp_enabled":true,"views":"16","promo_type":"1","layout_type":"1","short_excerpt":"Hackers stole over $10 million from THORChain across multiple networks.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=97124"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97124\/revisions"}],"predecessor-version":[{"id":97126,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97124\/revisions\/97126"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/97125"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=97124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=97124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=97124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}