Recently, Arkham Intelligence, a noted blockchain tracking firm, identified a group of suspicious cryptocurrency wallets associated with a major incident impacting THORChain. One of these wallets, linked to Bitcoin, reportedly contains approximately 36.85 BTC—valued around $3 million—and another wallet tied to Ethereum holds about 216 ETH. These addresses have already been publicly flagged by security analysts.

Initial Detection of the Incident

The first to uncover the suspicious activities was on-chain investigator ZachXBT. He noted unusual transactions related to THORChain’s routing system and detailed how attackers moved approximately $7.2 million worth of assets—including USDT, USDC, and wrapped Bitcoin—across multiple blockchains, subsequently converting them into Ethereum.

Initially, ZachXBT estimated the losses at above $7.4 million, but this figure was later revised to suggest that the total amount stolen could exceed $10 million.

Upon reviewing the numbers and the chains involved, the estimated stolen amount now appears to be above $10M.

— ZachXBT (@zachxbt) May 15, 2026

THORChain operates as a cross-chain trading protocol, allowing users to exchange cryptocurrency across various blockchain platforms without needing a centralized intermediary. However, this cross-chain nature has made it susceptible to vulnerabilities, evidenced by the attack that affected Bitcoin, Ethereum, BNB Chain, and Base simultaneously.

Additional investigations by PeckShield, a security firm, corroborated the breach. Their computations suggest that attackers secured approximately 36.75 BTC (around $3 million) alongside an estimated $7 million taken from Ethereum, BNB Chain, and Base.

Market Response and Institutional Communication

Following the news of the breach, the price of RUNE, THORChain’s native token, fell by approximately 14%, dipping toward the $0.50 threshold as traders sought to manage their risk exposure. This rapid decline heightened market tension, exacerbated by the absence of a prompt official statement from THORChain regarding the incident and its implications.

As of this reporting, THORChain has not provided any updates on the status or measures being undertaken to address the situation. This lack of communication has led to increased uncertainty among investors and participants in the market.

Recurring Challenges in Decentralized Finance

The THORChain incident highlights a troubling trend in the decentralized finance (DeFi) space. Cross-chain infrastructures are often targeted due to their inherent complexities, which can lead to vulnerabilities.

• Cross-chain bridges and routing systems are essential yet complicated.
• Increased complexity often leads to unforeseen security gaps.
• This incident reflects a growing pattern of significant losses within DeFi protocols.

The compromised assets currently remain within the flagged wallets, though their future movement remains uncertain.

Image credit: Unsplash; Chart source: TradingView