Blockchain tracking firm Arkham Intelligence has labeled a set of suspicious wallets as “THORChain Exploiter” addresses, with one Bitcoin-related wallet holding nearly 36.85 BTC – worth around $3 million – and a separate Ethereum wallet holding around 216 ETH. The funds are there, visible on the chain, linked to two addresses that security researchers have already reported publicly.
Who found it first
The person who spotted the attack before anyone else was on-chain investigator ZachXBT. It reported suspicious movement related to THORChain’s router infrastructure, describing how attackers transferred approximately $7.2 million in assets – including USDT, USDC and wrapped Bitcoin – across multiple blockchains before converting them to ETH.
Its initial estimate of losses in excess of $7.4 million was later revised upward. The total stolen, according to ZachXBT, could now exceed $10 million.
I can tell because they didn’t check the numbers/channels listed themselves.
I’ve finished the accounting again now and it looks like over $10 million was stolen.
-ZachXBT (@zachxbt) May 15, 2026
THORChain is a cross-chain trading protocol that allows users to trade crypto assets between different blockchains without relying on a centralized exchange. This design also means that its infrastructure touches multiple networks at once – and in this case, this has become a vulnerability. The attack affected Bitcoin, Ethereum, BNB Chain and Base simultaneously.
Security firm PeckShield independently confirmed the breach. Based on their estimates, the attackers walked away with approximately 36.75 BTC worth nearly $3 million, along with an additional approximately $7 million removed from the Ethereum, BNB Chain, and Base ecosystems.
The markets react, the team remains silent
RUNE, THORChain’s native token, fell nearly 14% in the hours following news of the breach, sliding towards the $0.50 mark as traders moved to reduce their exposure. The fall in prices was rapid. The official response was not.
At the time of reporting, THORChain had not released a public statement explaining the scope of the exploit or the steps taken to address it.
This silence added to market anxiety. The protocol has survived past security incidents by leveraging cash reserves and recovery mechanisms, but without clarity from the team, it is unclear whether a similar path is possible this time around.
A pattern that keeps repeating itself
Cross-chain infrastructure has repeatedly been the scene of major losses in decentralized finance. Bridges and routing systems that connect different blockchains require complex code – and complex code creates more opportunities for problems. The THORChain attack fits this pattern.
The stolen assets remain in the reported wallets for the time being. Whether they stay there is another question.
Featured image from Unsplash, chart from TradingView
Editorial process as Bitcoinist focuses on providing thoroughly researched, accurate and unbiased content. We follow strict sourcing standards and every page undergoes careful review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance and value of our content to our readers.
