THORChain pauses trading after $10M multi‑chain exploit

The decentralized cross‑chain liquidity protocol THORChain stopped all trading and signing on Thursday after a malicious node exploited a GG20 threshold‑signature vulnerability and drained roughly $10.7 million from a vault [1]. The breach triggered automatic solvency checks, halted activity within minutes, and left the RUNE token down about 13% at $0.51, intensifying pressure on a token that is already 72% lower year‑to‑date.

How the exploit unfolded

Investigators ZachXBT and PeckShield flagged abnormal outflows across Bitcoin, Ethereum, BNB Chain and Base, pinpointing a newly churned validator that used “progressive key material leakage” to rebuild a full private key for one vault [1][2]. The GG20 scheme normally splits key control among multiple node operators, preventing any single node from holding the complete key, but the flaw allowed the attacker to bypass that safeguard. Within minutes, THORChain’s built‑in solvency checks automatically halted signing and trading, and node operators coordinated a network‑wide pause via Discord [1].

Market reaction and protocol response

RUNE’s price fell roughly 13% to $0.51 after the exploit was reported, adding to a year‑to‑date decline of 72% [2][4]. The protocol’s post‑mortem noted that the automatic safeguards limited further loss, and a patch to the GG20 system has been deployed. THORChain’s governance is now debating recovery options through proposal ADR‑028, which would absorb losses with protocol‑owned liquidity and redirect future income to replenish it, without minting or selling additional RUNE [1].

Broader context

The incident arrives amid a surge in DeFi attacks that stole over $634 million in April alone, the highest monthly total since the $1.46 billion hack on Bybit in February 2025 [1][2]. THORChain has previously been used to funnel stolen assets, including the $293 million Kelp DAO exploit and the bulk of the $1.2 billion moved from the Bybit breach [2][4]. While the GG20 scheme remains in place, some observers question its long‑term robustness, noting “brittle assumptions” and urging scrutiny of alternative signing standards [1].

What to watch

• Price thresholds: $0.45 (near recent support) and $0.60 (short‑term resistance) as RUNE tests recovery momentum.
• Governance vote: Outcome of ADR‑028, which will determine whether protocol‑owned liquidity is used to cover the loss.
• On‑chain activity: Any large transfers from the flagged exploiter wallet (≈$10.8 million) or new vault key‑leakage signals.

The halt underscores how quickly a single node flaw can jeopardize a multi‑chain DeFi protocol, and whether THORChain’s patched GG20 design can restore confidence without further token dilution remains to be seen.