Thorchain RUNE token drops 13% after $10 million exploit, trading

RUNE slumped roughly 13% to $0.51 after a $10‑$10.8 million exploit forced Thorchain to halt all trading and signing operations, underscoring the protocol’s vulnerability and prompting a community‑driven recovery proposal【1】.

Exploit details and immediate impact

The attack leveraged a flaw in Thorchain’s GG20 threshold signature scheme, allowing a malicious node to reconstruct a full private key for a vault and drain about $10.7 million (reported as $10‑$10.8 million across sources)【2】. Automatic solvency checks triggered within minutes, halting signing and trading across multiple chains, and node operators coordinated a full network pause lasting roughly 12 hours and 42 minutes【2】. The exploit coincided with a broader surge in DeFi thefts, which totaled over $634 million in April alone【2】.

Market reaction and recovery path

RUNE’s price fell 13% to $0.51 in the immediate aftermath, extending a year‑to‑date decline of 72%【1】. CoinMarketCap data shows a 15.5% drop over the week, followed by a modest 4% bounce in the preceding 24 hours【2】. In response, Thorchain’s community opened governance proposal ADR‑028, which would absorb losses through protocol‑owned liquidity and redirect future income to replenish it, without minting or selling additional RUNE tokens【2】. The proposal also offers a bounty for returning stolen funds and plans to slash the attacker’s node while protecting innocent participants【2】.

On‑chain fallout

Arkham Intelligence identified the attacker’s wallets holding roughly 3,443 ETH (≈ $7.8 million), 36.85 BTC (≈ $3.0 million) and 96.6 BNB (≈ $66 k) after the exploit【3】. These holdings illustrate the cross‑chain nature of the theft, spanning Bitcoin, Ethereum, BSC and Base. Thorchain’s GG20 scheme remains in place, though co‑founder Chad Barraford noted that a planned migration to DKLS has been delayed and is now under closer review【2】.

What to watch

• Governance vote outcome: The ADR‑028 proposal’s acceptance or rejection will shape RUNE’s liquidity and future token issuance.
• On‑chain fund movements: Large transfers from the attacker’s wallets, especially any liquidation of ETH or BTC holdings, could pressure RUNE further.
• Protocol upgrades: Implementation of the patched GG20 or a shift to DKLS will be a key technical milestone for security confidence.

The exploit highlights the persistent risk in cross‑chain liquidity protocols and puts Thorchain’s governance and security roadmap under close scrutiny, leaving RUNE’s recovery path uncertain.