Thorchain Hack Drains $10M – ZachXBT Reports

THORChain, a cross-chain crypto trading protocol, was hit by a major hack that may have stolen over $10 million in digital assets across Bitcoin, Ethereum, BNB Chain, and Base. 

The attack sparked panic in the DeFi market, causing THORChain’s native token RUNE to drop more than 14% shortly after the exploit.

ZachXBT Flags Suspicious Multi-Chain Activity

The first warnings came from on-chain investigator ZachXBT, who reported suspicious activity linked to THORChain’s router infrastructure.

According to ZachXBT, attackers moved roughly $7.2 million worth of assets including USDT, USDC, and wrapped Bitcoin across multiple blockchain networks before swapping them into ETH.

The stolen funds were reportedly spread across Bitcoin, Ethereum, BNB Chain, and Base.

Initial estimates suggested losses exceeded $7.4 million, but ZachXBT later updated the figures, saying the total stolen amount may now exceed $10 million.

Another blockchain security firm, PeckShield, also confirmed the exploit, estimating that attackers stole around 36.75 BTC worth nearly $3 million, along with another $7 million in assets from the Ethereum, BNB Chain, and Base ecosystems.

Arkham Tracks Exploiter Wallets

Meanwhile, Arkham Intelligence labeled the suspicious wallets as “THORChain Exploiter” addresses while tracking millions of dollars in connected assets.

Data shared by Arkham showed one Bitcoin-linked wallet holding nearly 36.85 BTC worth roughly $3 million, while another Ethereum-linked wallet held around 216 ETH.

So far, most of the stolen remains are stored in the wallets linked to the addresses bc1ql4…f6f37 and 0xd4…890Bd.

RUNE Token Crash by 14%

The market reaction was immediate. Following news of the exploit, RUNE token price plunged roughly 14% within hours, falling toward the $0.50 level as traders rushed to reduce exposure.

While THORChain previously survived earlier exploits using treasury reserves and recovery mechanisms, the lack of immediate official communication has increased uncertainty around the scale of the latest breach.