# THORChain halts trading after $10 million exploit

**Published:** 2026-05-17T19:14:07.000Z  
**Topic:** Ethereum  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/7f2eb36c-f860-4816-9c9f-4ebbb25cb310

THORChain stopped all cross‑chain activity on May 15 2026 after a suspected exploit stole about $11 million across nine blockchains, prompting questions about

THORChain froze its entire protocol on Friday, May 15 2026, after security tools flagged unauthorized outbound transactions from an Asgard vault, resulting in an estimated $10.7‑$11 million loss across at least nine chains [2]. The exploit targeted the network’s threshold signature scheme that manages cross‑chain liquidity, allowing attackers to forge signatures and move assets from the vault without broader validator consent [3].

The stolen assets included roughly 36.75 BTC and balances on Ethereum, BNB Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash and the XRP Ledger [2]. THORChain’s automated monitoring system detected the abnormal behavior, triggering an emergency halt of trading, signing, and global chain operations to contain further damage [3]. The protocol’s team maintains that end‑user funds were not touched, asserting the loss came from operational vaults rather than retail accounts [2][3].

The breach highlights growing concerns over the complexity of multi‑party computation (MPC) used by decentralized exchanges. Ledger CTO Charles Guillemet warned that large‑language models are lowering the barrier to discover vulnerabilities in such intricate stacks, while Blockstream founder Adam Back called interactive MPC “fragile and novel” for ECDSA [2]. Both remarks point to a shifting threat model where sophisticated AI tools can accelerate exploit synthesis, potentially eroding the security guarantees of protocols that rely on many online validator shards.

THORChain’s token, RUNE, slid about 13 % after the incident, trading near $0.51 and remaining down 72 % over the past year [1]. The pause underscores that even “unstoppable” branding cannot shield a protocol from operational risk, and it may prompt validators and developers to reassess the trade‑off between cross‑chain flexibility and attack surface. As the investigation continues, the crypto community will watch whether THORChain can restore confidence and whether MPC‑based designs will survive heightened scrutiny.

## Sources
1. CoinTelegraph — [THORChain pauses trading after suspected $10M exploit](https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit)
2. Gizmodo — [‘Unstoppable’ Crypto Exchange Halts Trading After $10 Million Theft](https://gizmodo.com/unstoppable-crypto-exchange-halts-trading-after-10-million-theft-2000759775)
3. Moyens — [Crypto Exchange Halts Trading After $10M Theft; THORChain...](https://uk.moyens.net/tech/crypto-exchange-halts-trading-10m-theft-thorchain-funds-safe/)

---
Cite as: TrendWatcher, "THORChain halts trading after $10 million exploit", https://www.trendwatcher.in/article/7f2eb36c-f860-4816-9c9f-4ebbb25cb310