THORChain (RUNE)

$0.4396  -15.36%  24H

Social Sentiment Index (SSI)

Market Pulse Ranking (MPR)

X Posts

  • Vadim (AI, ⋈) OnChain_Analyst Security_Expert S
     12.47K  @zacodil

    Thorchain has been hacked six times in five years, and not once the same way. Each one through a different layer of the architecture. 2021 - Smart contract bug in the ETH Router. Attackers tricked Bifrost into reading manipulated msg.value events. ~$15.5M across three exploits. 2022 - Validator software bug. Non-deterministic behavior across nodes triggered a 20-hour outage. 2023 - TSS keygen vulnerability. Devs admitted a malicious validator could have drained vaults during a prior key generation. Network halted preemptively. 2025 (Jan) - Economic design failure. THORFi's lending model required RUNE to keep outperforming BTC/ETH. It didn't. $200M trapped. 2025 (Sep) - Social engineering. DPRK ran a Telegram deepfake on co-founder JP, extracted his MetaMask keys from iCloud Keychain. $1.35M lost. 2026 - TSS cryptography flaw. A malicious validator exploited the GG20 implementation, leaked key material across signing sessions, reconstructed the vault key. $10.7M drained. Plus: ~$605M of Bybit/Lazarus stolen funds laundered through in 2025. Validators voted to block, reversed under "code is law" pressure. Six distinct vectors: smart contract code, validator software, TSS keygen, economic design, social engineering, TSS cryptography. ~$227M directly lost or trapped. The architecture keeps finding new ways to fail.

     12  3  742
    Original >
    Trend of RUNE after release
     Extremely Bearish
    Thorchain five-year six attacks, loss over $227M, architecture vulnerabilities persist.
  • 蓝狐 OnChain_Analyst Security_Expert B
     73.19K  @lanhubiji

    Cross‑chain bridge/protocol attacks are often similar; fundamentally they exploit structural weaknesses in the cross‑chain mechanism. Cross‑chain protocols lock or hold large amounts of native assets (or liquidity), creating a "honey pot". This time THORChain affected multiple chains—BTC, ETH, BSC, and Base—because funds are distributed across chains while the verification/routing logic is unified. Historically, the attack vectors against cross‑chain bridges/protocols include: 1. Wormhole 2022 incident where $320 million was stolen, involving a signature verification bug, constituting a signature/verification bypass. 2. Nomad 2022 incident where $190 million was stolen: a misconfiguration allowed arbitrary messages to pass, representing a contract logic error. 3. Ronin 2022 incident where $250 million was stolen: 5 out of 9 keys were compromised, a multi‑signature/key breach. THORChain this time extracted funds via the Router contract and Vaults, similar to the "burn‑mint" or swap logic vulnerabilities of many liquidity bridges, constituting a Router/Vault/bridge component flaw. Between 2022 and 2026, bridge/cross‑chain related losses exceeded $2.8 billion, accounting for a large share of total DeFi hacking losses, and just last month the Kelp incident (LayerZero bridge, $290 million) occurred. Why do cross‑chain bridges/protocols keep encountering issues? Cross‑chain fundamentally connects chains with different security models, introducing additional complexity and trust assumptions, resulting in a larger attack surface than single‑chain DeFi: It involves multi‑chain smart contracts plus off‑chain components (validators, relayers, oracles). The security of a single chain does not equal overall security. If any part of the bridge code, message passing, or verification logic fails, the entire system can collapse. Some bridges/protocols also have imperfect trust models, such as reliance on multi‑sig/few validators (low threshold, easy to compromise); complex message verification (leading to fake deposit events, signature forgery, replay attacks); and upgrade/configuration risks (upgradeable contracts or parameter errors are often exploited).

    蓝狐 OnChain_Analyst Security_Expert B
     73.19K  @lanhubiji

    THORChain was hacked, resulting in losses of assets worth over $10 million, according to ZachXBT and on‑chain tracking: The affected chains include BTC, ETH, BNB, and Base – four chains in total. The assets involved are approximately 36.85 BTC (valued at about $2.97 million); about 3,443 ETH (valued at about $7.77 million); and a small amount of BNB. The hacker primarily siphoned funds via THORChain's Vaults (treasuries) and Router contract, then transferred/exchanged them across chains. Current developments are: The THORChain team has urgently halted all trades and signing operations (to prevent further loss); the RUNE token price dropped more than 10% in the short term. This is a typical cross‑chain bridge/liquidity protocol security incident, representing a common DeFi risk.

     10  5  2.64K
    Original >
    Trend of RUNE after release
     Bearish
    THORChain suffered a hacker attack resulting in losses exceeding ten million dollars, with the RUNE token falling, highlighting the security risks of cross‑chain bridges.
  • Cryptosailor Dev Researcher B
     2.21K  @robertdavid010
    Chainalysis D
     63.16K  @chainalysis

    Before stealing $9.8M from #THORChain, likely attacker-connected wallets spent weeks moving its own funds through Monero, Hyperliquid, and THORChain. On-chain activity ties them to the wallet that would later receive millions of stolen funds. It started with Monero. 1/5

     158  10  19.87K
    Original >
    Trend of RUNE after release
     Bearish
    THORChain was stolen of $9.8M, with the attacker first laundering through Monero and Hyperliquid
  • GaoGao FA_Analyst Educator B
     2.27K  @gaogaocrypto

    Hack Season ? THORChain had to suspend trading activities after security researchers (ZachXBT and PeckShield) discovered a multi-chain exploit affecting the Bitcoin, Ethereum, BNB Smart Chain, and Base networks. The estimated loss is around $10.7M. Thorchain has confirmed the issue but has not released any notice about individual users being affected. Following this news, the $RUNE token price dropped about 17% within the past 24 hours. If you haven't forgotten, this is not the first time THORChain has experienced this situation. Previously there were two incidents: a debt crisis in January 2025, followed by a hack of the founder's personal wallet in September 2025. It is unclear whether this is a “Hack season” or something else hard to describe about multi-chain projects.

    The Block D
     579.89K  @TheBlockCo

    BREAKING: THORCHAIN APPEARS TO HAVE BEEN EXPLOITED ACROSS BITCOIN, ETHEREUM, BSC AND BASE FOR MORE THAN $7.4 MILLION — ZACHXBT https://t.co/3S1RzXYZuK

     7  7  370
    Original >
    Trend of RUNE after release
     Extremely Bearish
    THORChain suffered a multi-chain attack, RUNE plunged 17% and trading was halted.
  • Vladimir S. | Officer's Notes Security_Expert Researcher S
     51.22K  @officer_secret

    It looks like Thorchain was likely exploited on Bitcoin, Ethereum, BSC, Base for $10M+ Theft address: bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37 0x82fc0d5150f3548027e971ec04c065f3c93154eb Initially spotted by @zachxbt ! According to @banteg, it’s related to this patch: https://t.co/6MLEITlPh2 as validators signed too little data, so a proposer could change how THORChain interpreted an observation without invalidating the signatures.

    Vladimir S. | Officer's Notes Security_Expert Researcher S
     51.22K  @officer_secret

    Data by @arkham ⬇️ https://t.co/IDMAizz2zc

    Vladimir S. | Officer's Notes Security_Expert Researcher S
     51.22K  @officer_secret

    @arkham Official statement ⬇️

    Vladimir S. | Officer's Notes Security_Expert Researcher S
     51.22K  @officer_secret

    @arkham Another explanation ⬇️

    Vladimir S. | Officer's Notes Security_Expert Researcher S
     51.22K  @officer_secret

    @arkham More information ⬇️

     26  2  2.91K
    Original >
    Trend of RUNE after release
     Extremely Bearish
    THORChain platform suffered a theft of over $10 million across BTC, ETH, BSC, and Base networks.
  • Vini B |「 thecoding 」 Security_Expert OnChain_Analyst B
     11.38K  @vinibarbosabr
    Vini B |「 thecoding 」 Security_Expert OnChain_Analyst B
     11.38K  @vinibarbosabr

    THORChain had ~$10M drained from one of its vaults Let's take a look at what happened, the exploit, and the interesting timeline of another vault churn/migration security issue discussed in @THORChain's gitlab that I discovered earlier today and posted below THORChain is one of the most used decentralized cross-chain networks, which makes these events super relevant to the entire ecosystem! According to @theoblivionsage's analysis, the attacker was able to get `_vaultAllowance` over a THORChain vault during what looked like a legit ERC20 vault migration Allowance was given via an Ethereum transaction caling the `transferAllowance()` function, allowing the attacker to sign outbound transactions from this THORChain vault they now control Think of it like a company that has a bank account this account has a password that allows to move the money out of the account, according to the company's needs the password is owned by one manager at a time, but it might change hands from time to time for security reas

     54  5  5.20K
    Original >
    Trend of RUNE after release
     Bearish
    RUNE suffered an approximate $10 million theft, indicating significant security risk
  • Vadim (AI, ⋈) OnChain_Analyst Security_Expert S
     12.47K  @zacodil

    Thorchain didn't lose $10.7M to a smart contract bug or a stolen key. The bug was in the cryptography itself - and Thorchain probably isn't the only chain running on it. A single attacker bonded RUNE and joined the validator set days before the incident, looking like any legitimate operator. From inside, they exploited what investigators currently believe was a flaw in GG20, the threshold signature library Thorchain uses to co-sign transactions. Each signing session leaked a fragment of private key material to the attacker's node. After enough sessions, they had collected enough leaked data to mathematically reconstruct the vault's full private key. Then they signed unauthorized outbound transactions as the vault. The smart contracts behaved correctly. No validator infrastructure was breached. Funds left through normal channels because the signatures were mathematically valid - just produced by an attacker who had silently rebuilt the key. Here's why this matters beyond Thorchain. GG20 was published in 2020 (Gennaro-Goldfeder). The Alpha-Rays attack (Verichains, 2023) and TSSHOCK at BlackHat 2023 documented practical weaknesses in tss-lib and related implementations. Some teams patched. Many didn't bother. Based on shared library lineage, protocols that should audit their TSS right now include Mayachain (direct THORChain fork), Sygma cross-chain bridge, Keep Network's tBTC v1, and any service still running on bnb-chain/tss-lib or ZenGo-X/multi-party-ecdsa. Major custody and MPC services that already migrated to newer threshold schemes (CGGMP21, DKLs): Fireblocks, Coinbase Custody, Taurus, Silence Laboratories. The industry has been quietly moving away from GG20 for two years. Thorchain just gave everyone still on it a reason to move faster.

    THORChain D
     288.77K  @THORChain

    THORChain incident update #1 THORChain contributors shared a new update in the dev discord regarding the ongoing incident. TLDR - Current evidence points toward a newly churned node linked to the attack, likely operated by a single malicious actor - The leading theory is an exploit in the GG20 TSS implementation, allowing vault key material to leak over time. The attacker may have reconstructed the vault private key and executed unauthorized outbound txs - Current network status: -- The network is paused after multiple node operators executed make pause -- RUNE transfers and chain observation may resume within ~12h unless decided otherwise by the nodes. -- Trading, LP actions, signing, and sensitive operations remain paused for now - Recovery discussions currently include slashing affected node bonds, using POL to absorb losses, or other community-driven solutions The investigation is still ongoing alongside THORSec and Outrider Analytics. ## Full Announcement ## Developers and THORSec have been invest

     278  19  45.31K
    Original >
    Trend of RUNE after release
     Bearish
    RUNE was forced to migrate due to a security risk caused by a GG20 threshold signature vulnerability leak.
  • Jeremy Trader Derivatives_Expert C
     280.19K  @Jeremybtc

    The crypto protocol that laundered $1.2 BILLION from the Bybit hack just got drained itself. THORChain lost $10.8 MILLION across four chains in a single attack today. THORChain is a decentralized cross chain exchange. No KYC. No intermediaries. It offers direct swaps between Bitcoin, Ethereum, BNB Chain, Base and every major network. Processing BILLIONS in volume and asking no questions about where funds come from. That last part is why it became the cash out layer of choice for every major crypto hack in the last two years. The Bybit hackers ran $1.2 BILLION through it. The KelpDAO exploiter ran roughly $80 MILLION through it. The IoTeX bridge hacker bridged stolen funds through it earlier this year. Today the same protocol got robbed for itself. Security firms Cyvers and PeckShield flagged the breach on May 15. Suspicious transactions detected across Bitcoin, Ethereum, BSC and Base simultaneously. Assets drained include USDT, USDC, WBTC, DAI, THOR, LUSD, XRUNE, GUSD, AAVE, LINK and FOX. Everything was converted to ETH and funnelled into a single Ethereum address. 0xd477b69551f49C0519F9B18c55030676138890Bd. A separate 36.85 BTC worth $3 MILLION sits in a single Bitcoin address. Total losses now estimated at $10.8 MILLION. THORChain has halted all trading and signing. RUNE dropped 12 to 15% within hours. Reliability was the only thing THORChain sold. Today it ran out.

     80  34  5.76K
    Original >
    Trend of RUNE after release
     Extremely Bearish
    THORChain was attacked, losing $10.8 million, RUNE plummeted, reliability lost.
  • Vini B |「 thecoding 」 Security_Expert OnChain_Analyst B
     11.38K  @vinibarbosabr
    Vini B |「 thecoding 」 Security_Expert OnChain_Analyst B
     11.38K  @vinibarbosabr

    interesting timeline here in THORChain's repo an old issue related to vault churn/migrations has been reactivated in the context of a vault `transferAllowance()` exploit on @THORChain + security issue raised in Jan 2023 by Mr. Smith + Son of Odin closes the issue in Jul 2023 + Jack Zampolim proposes reopening it in Aug 2024 + a few discussions follow the reopening for a month + radio silence until 2 months ago + Son of Odin added a `priority` flag in Feb 2026 + THORChain gets hacked on May 15, 2026 for ~$10M + Mr. Smith adds a note a few hours after the attack: > "In light of recent events related to Thorchain vaults being exploited, will monitor and update this thread/issue with any relevant content, and be available for discussion of this if required." a video is coming discussing the hack and this thread before speculations begin: the issue described in this thread doesn't seen to be directly related to today's exploit on thorchain:native (and i'm not sure it's patch would have prevented what happene

     31  2  4.25K
    Original >
    Trend of RUNE after release
     Bearish
    THORChain was attacked, incurring a $10M loss, and the timeline of an old security vulnerability discussion has been revealed.
  • crypto.news Media Influencer C
     117.70K  @cryptodotnews

    JUST IN: THORChain reports suspected exploit via newly churned node and GG20 TSS vault key leak. Network paused. RUNE transfers/chain observation may resume in ~12h. Trading/LP/signing remain paused https://t.co/4m98GnyGEg

    crypto.news Media Influencer C
     117.70K  @cryptodotnews

    JUST IN: THORChain exploited across Bitcoin, Ethereum, BSC and Base chains with stolen funds already exceeding $10m, per ZachXBT https://t.co/mD8Srl7Mam

     10  1  1.42K
    Original >
    Trend of RUNE after release
     Extremely Bearish
    THORChain suffered an attack exceeding ten million dollars, network paused.