Decentralized cross-chain liquidity protocol THORChain halted all trading and signing after blockchain investigator ZachXBT flagged a suspected exploit of over $10 million. The THORChain alerts Telegram channel announced a global node pause extending until block 26191149, or roughly 12 hours and 42 minutes. A wallet labeled by Arkham as the THORChain exploiter held $10.8 million, transferred via several small transactions shortly before the halt. The suspected exploit adds to mounting DeFi security concerns, following over $634 million stolen in April 2025, the highest monthly sum since the $1.46 billion Bybit hack in February. RUNE token fell 13% to around $0.51. THORChain has not publicly confirmed the exploit, though ZachXBT and PeckShield flagged suspicious activity. The protocol has previously been used by hackers to swap stolen funds, including the Kelp DAO and Bybit exploits.

Key facts

• THORChain halted trading after suspected $10M+ exploit flagged by ZachXBT.
• Global node pause extended to block 26191149, about 12 hours 42 minutes.
• Exploiter wallet held $10.8M, moved via small transactions before halt.
• RUNE token dropped 13% to ~$0.51 after the suspected exploit.
• Protocol previously used by hackers in Kelp DAO and Bybit heists.