{"id":72559,"date":"2026-05-15T12:10:53","date_gmt":"2026-05-15T12:10:53","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/thorchain-loses-nearly-11m-as-attackers-poison-vault-churn-process-across-4-chains-bitcoin-news\/"},"modified":"2026-05-15T12:10:53","modified_gmt":"2026-05-15T12:10:53","slug":"thorchain-loses-nearly-11m-as-attackers-poison-vault-churn-process-across-4-chains-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/thorchain-loses-nearly-11m-as-attackers-poison-vault-churn-process-across-4-chains-bitcoin-news\/","title":{"rendered":"Thorchain Loses Nearly $11M as Attackers Poison Vault Churn Process Across 4 Chains \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Thorchain lost approximately $10 to $11 million across Bitcoin, Ethereum, BSC, and Base on May 15, 2026.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">ZachXBT flagged the exploit publicly as RUNE dropped 12 to 15% within hours, falling to roughly $0.50.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Node operators triggered a global emergency halt; a full post-mortem from Thorchain is still pending.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Thorchain Funds Compromised<\/h2>\n<p>Onchain investigator ZachXBT first <a href=\"https:\/\/t.me\/investigations\/319\" target=\"_blank\" rel=\"noopener noreferrer\">flagged<\/a> the incident via his Telegram channel, placing initial losses above $7.4 million before revised estimates pushed the total higher. The breach hit vaults on <span>Bitcoin<\/span>, Ethereum, <span>BNB<\/span> Smart Chain, and Base.<\/p>\n<p>The attack method centered on a vault churn, a standard <a href=\"https:\/\/news.bitcoin.com\/balancer-exploiter-resurfaces-thorchain-eth-btc\/\">Thorchain<\/a> process in which <span>node<\/span> operators rotate in and out while assets are redistributed using threshold signature schemes. Attackers appear to have injected malicious addresses into that process, tricking the system into authorizing transfers it should not have approved.<\/p>\n<p>Stolen assets include roughly 3,443 <span>ETH<\/span> valued at $7.77 million, 36.85 <span>BTC<\/span> worth approximately $2.97 million, 96.6 <span>BNB<\/span> worth around $66,000, and additional tokens, including early reports of 798,000 USDC. Three theft addresses were publicly flagged across <span>Bitcoin<\/span> and Ethereum for tracking by security firms.<\/p>\n<p> <span>Node<\/span> operators responded quickly by triggering Thorchain\u2019s decentralized global emergency halt through the protocol\u2019s Mimir governance settings. The halt suspended swaps, vault churning, and signing on affected chains beginning around block 26190429. RUNE transactions on the native chain continued in limited capacity.<\/p>\n<p>RUNE, Thorchain\u2019s native token, fell 12 to 15% within hours of ZachXBT\u2019s alert. The token dropped from around $0.58 to roughly $0.50 across major exchanges. <span>Liquidity<\/span> providers and users remain on hold while security firms, including Peckshield and Cyvers monitor the flagged addresses.<\/p>\n<p> <iframe src=\"https:\/\/markets.bitcoin.com\/crypto\/thorchain\/embed\" width=\"100%\" style=\"max-height:500px;height:500px;border:none;overflow:hidden;border-radius:4px\" scrolling=\"no\" title=\"thorchain market data\"><\/iframe> <\/p>\n<p>As of the time of writing, the @Thorchain account on X had not posted publicly about the exploit. No official post-mortem has been released, and the funds at the identified addresses appear largely dormant.<\/p>\n<p>Thorchain has faced protocol-level attacks before. In July 2021, multiple exploits targeting the <span>ETH<\/span> router drained between $4.9 million and $8 million. The team covered losses from the treasury and paused the protocol for fixes. This current exploit follows a different threat profile but hits a familiar weak point: the vault migration process.<\/p>\n<p>The protocol\u2019s architecture was built to avoid centralized failure points. It runs more than 90 decentralized <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-a-bitcoin-node\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">nodes<\/a>, holds no single admin key, and avoids wrapped assets. That design has held up against certain attack types, but the churn process has now been identified as an exploitable surface.<\/p>\n<p>Thorchain also drew attention in 2025 and early 2026 as a passage for funds connected to the Bybit hack, attributed to the <a href=\"https:\/\/news.bitcoin.com\/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit\/\">Lazarus Group<\/a> with losses near $1.4 billion, and the KelpDAO incident involving more than $175 million in ETH-to- <a href=\"https:\/\/www.binance.com\/en\/price\/bitcoin\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">BTC<\/a> swaps. Those flows generated fees for the protocol but drew criticism from compliance and security researchers.<\/p>\n<p>This is a developing story. Investigations remain active, and <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-liquidity\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">liquidity<\/a> providers should avoid interacting with the protocol until trading resumes and full details are confirmed. A detailed post-mortem from Thorchain\u2019s <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-a-bitcoin-node\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">node<\/a> operators is expected once the situation stabilizes.<\/p>\n<p>Updates will appear on Thorchain\u2019s documentation pages, the @Thorchain X account, and the Midgard API as they become available.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/thorchain-loses-nearly-11m-as-attackers-poison-vault-churn-process-across-4-chains\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Thorchain lost approximately $10 to $11 million across Bitcoin, Ethereum, BSC, and Base on May 15, 2026. ZachXBT flagged the exploit publicly as RUNE dropped 12 to 15% within hours, falling to roughly $0.50. Node operators triggered a global emergency halt; a full post-mortem from Thorchain [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":72560,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/72559"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=72559"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/72559\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/72560"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=72559"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=72559"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=72559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}