Thorchain Hack Drains $10M – ZachXBT Reports

Published by

Rizwan Ansari

May 15, 2026

Unleash Protocol Hack Drains $3.9M After Multisig Exploit, PeckShield Reveals

THORChain, a cross-chain crypto trading protocol, was hit by a major hack that may have stolen over $10 million in digital assets across Bitcoin, Ethereum, BNB Chain, and Base.

The attack sparked panic in the DeFi market, causing THORChain’s native token RUNE to drop more than 14% shortly after the exploit.

ZachXBT Flags Suspicious Multi-Chain Activity

The first warnings came from on-chain investigator ZachXBT, who reported suspicious activity linked to THORChain’s router infrastructure.

According to ZachXBT, attackers moved roughly $7.2 million worth of assets including USDT, USDC, and wrapped Bitcoin across multiple blockchain networks before swapping them into ETH.

The stolen funds were reportedly spread across Bitcoin, Ethereum, BNB Chain, and Base.

Initial estimates suggested losses exceeded $7.4 million, but ZachXBT later updated the figures, saying the total stolen amount may now exceed $10 million.

Another blockchain security firm, PeckShield, also confirmed the exploit, estimating that attackers stole around 36.75 BTC worth nearly $3 million, along with another $7 million in assets from the Ethereum, BNB Chain, and Base ecosystems.

Arkham Tracks Exploiter Wallets

Meanwhile, Arkham Intelligence labeled the suspicious wallets as “THORChain Exploiter” addresses while tracking millions of dollars in connected assets.

Data shared by Arkham showed one Bitcoin-linked wallet holding nearly 36.85 BTC worth roughly $3 million, while another Ethereum-linked wallet held around 216 ETH.

So far, most of the stolen remains are stored in the wallets linked to the addresses bc1ql4…f6f37 and 0xd4…890Bd.

RUNE Token Crash by 14%

The market reaction was immediate. Following news of the exploit, RUNE token price plunged roughly 14% within hours, falling toward the $0.50 level as traders rushed to reduce exposure.

While THORChain previously survived earlier exploits using treasury reserves and recovery mechanisms, the lack of immediate official communication has increased uncertainty around the scale of the latest breach.

Trust with CoinPedia:

CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.

Investment Disclaimer:

All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.