# Thorchain exploit causes $10.7 M loss, RUNE drops 13%

**Published:** 2026-05-15T10:20:58.000Z  
**Topic:** Ethereum  
**Sentiment:** bearish  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/99447626-fad7-47d9-a111-4f9d2205c063

Thorchain hack drains $10.7 M via GG20 flaw, pushing RUNE token 13% lower to $0.51; see how the protocol halted trading and its recovery plan.

The RUNE token fell about 13% to roughly $0.51 after a $10.7 million exploit that let a malicious node reconstruct a vault’s private key through a GG20 threshold‑signature flaw, prompting Thorchain to halt all trading and signing within two hours [2].

| At a glance | |
|---|---|
| Loss amount | $10.7 million |
| RUNE price | $0.51 |
| 24h move | –13% |
| Catalyst | GG20 vulnerability & network halt |

## Exploit mechanics and immediate response  
Thorchain’s post‑mortem says a single node operator leveraged a “progressive key material leakage” in the GG20 threshold‑signature scheme to rebuild a full private key for one vault, draining the $10.7 million [2]. The protocol’s automatic solvency checks detected the breach within minutes, automatically stopping signing and trading across supported chains. Node operators coordinated on Discord and paused the network for roughly two hours before deploying a patch to the GG20 stack [2].

## Market impact and recovery path  
The breach coincided with a sharp 13% slide in RUNE, taking the token to $0.51 and extending its year‑to‑date decline of 72% [1]. In the week after the exploit, RUNE fell 15.5% before clawing back about 4% in the 24 hours preceding Friday’s 11:00 a.m. UTC snapshot [2]. Thorchain’s governance proposal ADR‑028, now open for node‑operator votes, outlines a recovery that would first draw on protocol‑owned liquidity, then allocate a portion of future protocol income to replenish the pool without minting or selling additional RUNE [2]. A bounty for returning the stolen funds and a slash of the attacker’s node have also been announced [2].

## Broader context  
Thorchain has previously been used to move large illicit sums, including $910 k from the Kelp DAO exploit and roughly $1.2 billion from the Bybit hack, though it is not a mixer like Tornado Cash [1]. The $10.7 million loss adds to an April surge in DeFi exploits that collectively exceeded $634 million, according to DefiLlama data [2].

## What to watch
- RUNE price at $0.45 (next support) and $0.60 (near‑term resistance).  
- Outcome of ADR‑028 vote and any subsequent protocol‑owned liquidity adjustments.  
- On‑chain activity indicating whether the stolen funds are being moved or consolidated.

The exploit underscores the fragility of threshold‑signature schemes in cross‑chain DeFi and leaves open whether Thorchain’s patched GG20 stack can regain user confidence without further breaches.

## Sources
1. CoinTelegraph — [THORChain pauses trading after suspected $10M exploit](https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit)
2. CoinTelegraph — [THORChain exploit tied to malicious node and GG20 flaw](https://cointelegraph.com/news/thorchains-10m-exploit-mpc-vulnerability-private-key-leak)

---
Cite as: TrendWatcher, "Thorchain exploit causes $10.7 M loss, RUNE drops 13%", https://www.trendwatcher.in/article/99447626-fad7-47d9-a111-4f9d2205c063