# THORChain pauses trading after $10M multi‑chain exploit

**Published:** 2026-05-15T11:36:40.000Z  
**Topic:** Ethereum  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/0e80f380-b3a8-40c9-b314-13ae51f9f24f

THORChain halted all trading after a suspected $10.7 million exploit, sending RUNE down ~13% to $0.51. Learn the breach details, protocol response, and next

The decentralized cross‑chain liquidity protocol THORChain stopped all trading and signing on Thursday after a malicious node exploited a GG20 threshold‑signature vulnerability and drained roughly $10.7 million from a vault [1]. The breach triggered automatic solvency checks, halted activity within minutes, and left the RUNE token down about 13% at $0.51, intensifying pressure on a token that is already 72% lower year‑to‑date.

| At a glance | |
|---|---|
| Exploit size | $10.7 million drained |
| RUNE price | $0.51 (‑13% on news) |
| Trading halt | Until block 26191149 (~12 h 42 m) |
| Catalyst | GG20 threshold‑signature flaw enabling key reconstruction |

## How the exploit unfolded
Investigators ZachXBT and PeckShield flagged abnormal outflows across Bitcoin, Ethereum, BNB Chain and Base, pinpointing a newly churned validator that used “progressive key material leakage” to rebuild a full private key for one vault [1][2]. The GG20 scheme normally splits key control among multiple node operators, preventing any single node from holding the complete key, but the flaw allowed the attacker to bypass that safeguard. Within minutes, THORChain’s built‑in solvency checks automatically halted signing and trading, and node operators coordinated a network‑wide pause via Discord [1].

## Market reaction and protocol response
RUNE’s price fell roughly 13% to $0.51 after the exploit was reported, adding to a year‑to‑date decline of 72% [2][4]. The protocol’s post‑mortem noted that the automatic safeguards limited further loss, and a patch to the GG20 system has been deployed. THORChain’s governance is now debating recovery options through proposal ADR‑028, which would absorb losses with protocol‑owned liquidity and redirect future income to replenish it, without minting or selling additional RUNE [1].

## Broader context
The incident arrives amid a surge in DeFi attacks that stole over $634 million in April alone, the highest monthly total since the $1.46 billion hack on Bybit in February 2025 [1][2]. THORChain has previously been used to funnel stolen assets, including the $293 million Kelp DAO exploit and the bulk of the $1.2 billion moved from the Bybit breach [2][4]. While the GG20 scheme remains in place, some observers question its long‑term robustness, noting “brittle assumptions” and urging scrutiny of alternative signing standards [1].

## What to watch
- **Price thresholds:** $0.45 (near recent support) and $0.60 (short‑term resistance) as RUNE tests recovery momentum.  
- **Governance vote:** Outcome of ADR‑028, which will determine whether protocol‑owned liquidity is used to cover the loss.  
- **On‑chain activity:** Any large transfers from the flagged exploiter wallet (≈$10.8 million) or new vault key‑leakage signals.

The halt underscores how quickly a single node flaw can jeopardize a multi‑chain DeFi protocol, and whether THORChain’s patched GG20 design can restore confidence without further token dilution remains to be seen.

## Sources
1. CoinTelegraph — [THORChain exploit tied to malicious node and GG20 flaw](https://cointelegraph.com/news/thorchains-10m-exploit-mpc-vulnerability-private-key-leak)
2. Tradingview — [THORChain pauses trading after suspected $10M exploit — TradingView News](https://www.tradingview.com/news/cointelegraph:566bae2b4094b:0-thorchain-pauses-trading-after-suspected-10m-exploit/)
3. The Block — [THORChain pauses trading as security researchers flag suspected $10M multi-chain exploit | The Block](https://www.theblock.co/post/401462/thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit)
4. Cointelegraph — [THORChain Halts Trading After ZachXBT Flags $10M Exploit](https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit)
5. Yellow — [Thorchain Opens $10M Compensation Portal After Multichain Exploit Drains Four Networks](https://yellow.com/news/thorchain-10m-compensation-portal-multichain-exploit-2026)

---
Cite as: TrendWatcher, "THORChain pauses trading after $10M multi‑chain exploit", https://www.trendwatcher.in/article/0e80f380-b3a8-40c9-b314-13ae51f9f24f