THORChain paused trading after blockchain security researchers ZachXBT and PeckShield flagged a suspected exploit spanning Bitcoin, Ethereum, BNB Smart Chain and Base, with estimated losses of more than $10 million.
ZachXBT and PeckShield both identified two alleged theft addresses on the Bitcoin network and EVM-compatible chains. It’s important to note that they characterized the exploit as likely but not yet confirmed.
The incident adds to a pattern of previous security and operational disruptions involving the cross-chain liquidity protocol.
THORChain previously suspended its ThorFi lending operations in January 2025 amid insolvency allegations and implemented a 90-day restructuring through validators.
The protocol subsequently resolved a $200 million debt crisis by converting defaulted obligations into a new equity-style token.
In September 2025, THORSwap issued a bounty following a roughly $1.2 million exploit of THORChain founder John-Paul Thorbjornsen’s personal wallet, which ZachXBT linked to North Korean hackers.
The protocol has also emerged repeatedly as a cross-chain laundering route in unrelated exploits.
One of the most recent cases occurred when funds from the Kelp DAO hack were moved from ETH to BTC via THORChain, spiking its daily volume to $394 million, as The Block reported.
This is a developing story.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.