THORChain RUNE Falls After $10M Exploit Halt
THORChain halted trading on Friday after blockchain investigators said the protocol was likely hit by a suspected cross-chain exploit that may have drained about $10 million, sending RUNE sharply lower even as some traders appeared to keep buying into the weakness [1][2][10]. The pause matters now because THORChain sits at the center of cross-chain liquidity, and a security event of this size can quickly alter trader confidence, short-term flow, and the token’s risk premium.
## Overview
- THORChain paused trading after investigators flagged a suspected exploit. The move followed reports of losses near $10 million across multiple chains, limiting immediate protocol activity [1][10].
- ZachXBT and PeckShield traced activity to addresses linked to Bitcoin and EVM networks. That raised the likelihood of a cross-chain breach rather than a single-chain wallet incident [1].
- RUNE fell double digits after the news. CoinGecko-based reporting put the token near $0.52, underscoring how quickly security incidents can hit market value [1][4].
- Reported losses varied across coverage. Estimates ranged from about $7.4 million to roughly $10.8 million, which leaves the final figure unsettled [3][10].
- The incident coincided with heavy THORChain activity. One report cited $394 million in daily volume, suggesting the protocol was under active use even as the pause was announced [4].
- Developers had not provided a technical explanation at the time of reporting. That leaves open questions about the breach source, recovery prospects, and whether the halt will extend [1][10].
Subscribe to our Social Media for Exclusive Crypto News and Insights 24/7!
## THORChain pauses after exploit reports
The THORChain RUNE move came after on-chain investigator ZachXBT said the protocol likely suffered a fresh exploit, with PeckShield separately identifying losses tied to Bitcoin, BNB Chain, Ethereum, and Base [1][2][10]. THORChain then suspended trading activity while it assessed the situation [1][4][10].
The loss estimate was not fully settled. Early reports cited about $7.4 million, while later updates pushed the figure to about $10.7 million and other coverage placed it near $10.8 million [2][3][10]. That spread matters because it shows the incident was still developing as traders reacted.
### Reported loss estimates
| Source cluster | Estimate | Notes |
|---|---|---|
| Early investigator reporting | About $7.4 million | Initial estimate across Bitcoin and EVM-linked chains [3] |
| Updated investigator reporting | About $10.7 million | Later revision following additional tracing [2] |
| Subsequent coverage | About $10.8 million | Rounded estimate across four blockchains [10] |
## RUNE weakens as traders react
RUNE dropped sharply after the reports, with one market snapshot putting the token near $0.5229 and down about 10% on the day [1][4]. Other reports showed a larger intraday decline of roughly 15%, with the token falling from above $0.58 to around $0.50 before stabilizing somewhat [3].
That price action points to a familiar pattern in crypto: security incidents tend to compress liquidity and force traders to reprice operational risk immediately. Analysts note that when a protocol halts trading, the market is not just pricing the token itself; it is also pricing uncertainty around whether the event is contained, whether funds are recoverable, and whether the outage will persist.
### Price reaction across reports
| Report | Price move | Reference point |
|---|---|---|
| CoinGecko-based coverage | About -10% | RUNE near $0.5229 [1][4] |
| Investigator-linked reporting | About -15% | Move from above $0.58 toward $0.50 [3] |
| Broader market summary | About -12% | Trading halt after exploit report [10] |
The “retail still buying” angle is harder to verify directly from the available reporting. What can be confirmed is that the token continued to trade through the shock and that the market found some support after the first leg lower [3]. Interpretation based on available data: some buyers likely viewed the post-halt decline as a short-term dislocation rather than a permanent impairment, but the sources do not provide a clean retail-flow readout.
## Why the THORChain exploit matters
THORChain is a cross-chain liquidity protocol, so any exploit allegation goes beyond a single-token story [4][5][10]. Market participants view these incidents as stress tests for the wider cross-chain ecosystem because they can affect trust in bridge-like infrastructure, even when the exact attack path is still under review.
The timing also matters. One report said the suspected exploit surfaced during a period of elevated usage, with daily transaction volume around $394 million [4]. That creates a sharper operational risk: when activity is high, any pause can disrupt routing, degrade confidence, and push users toward competing venues.
### What the market is likely pricing
| Issue | Immediate effect | Market relevance |
|---|---|---|
| Trading halt | Reduced protocol activity | Limits swaps and unsettles users [1][10] |
| Unsettled loss size | Wider uncertainty band | Keeps pressure on token valuation [2][3][10] |
| Cross-chain exposure | Broader surface area | Raises perceived infrastructure risk [1][10] |
| High prior volume | Larger user disruption | Increases the cost of downtime [4] |
There is also a downside scenario for holders. If the investigation confirms a larger loss, or if the halt extends longer than expected, RUNE could face another leg down as liquidity providers and traders reassess exposure. A second risk is that inconsistent early estimates may erode confidence further if the final incident summary differs materially from what market participants priced in at first.
## Unresolved questions remain
THORChain’s team had not publicly confirmed the exact vulnerability or the final loss amount in the reports reviewed [1][10]. That is a key uncertainty. Without a technical disclosure, investors cannot yet separate a contained incident from a deeper protocol failure.
The recovery outlook is also unclear. The available sources do not show any verified fund recovery, and no enforcement action had been announced in the material reviewed. For now, the main market takeaway is narrower: security risk, not token fundamentals, is driving the tape.
A clear readthrough for the market is that cross-chain protocols remain highly sensitive to even preliminary exploit allegations. If THORChain restores operations cleanly, the damage may stay contained to a short-term trust shock. If not, the incident could keep weighing on RUNE and on investor appetite for similar infrastructure until the protocol gives a fuller account of what happened.
1. https://www.bitget.com/news/detail/12560605413885
2. https://cryptopotato.com/rune-plunges-by-15-as-thorchain-falls-victim-to-new-hack-zachxbt/
3. https://bingx.com/en/news/post/rune-drops-after-zachxbt-says-thorchain-may-have-been-exploited
4. https://finance.yahoo.com/markets/crypto/articles/thorchain-rune-token-plunges-double-105824001.html
5. https://www.mexc.com/news/1095384
6. https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12
