THORChain (RUNE)

Is the bear market truly the “busy season” for hacker teams? 👀 Yesterday, the cross-chain liquidity protocol @THORChain was hacked for $10.8M. What #Web3钱包 users should pay attention to isn’t how much money was lost, but that the attackers had been lurking for weeks before striking. 👇

Early morning of May 15, @zachxbt and @peckshield both issued alerts: THORChain’s liquidity pools were bleeding abnormally, with BTC, ETH, BNB Chain, and Base all affected simultaneously. In the end, the team estimated the loss at about $10.8M, comprising 3,443 ETH + 36.85 BTC + 96.6 BNB, which were stolen almost the moment the attack occurred. After the THORChain team discovered the issue, they immediately halted trading and signing operations. RUNE promptly dropped 13%, from $0.58 to $0.50.

Afterwards, @chainalysis reconstructed the entire attack timeline: ① Several weeks ago / Building a cover layer The attackers used Monero (privacy coin) via the Hyperliquid‑Monero privacy bridge to establish an initial fund position on Hyperliquid. No identity or KYC on‑chain. ② A few days ago / Infiltrating a validator node The attackers bridged ETH into THORChain, bonded RUNE, masquerading as a new legitimate validator node, quietly joining the active validator set. The protocol accepted the node. ③ 43 minutes before the attack / Final funds in place An intermediary wallet transferred 8 ETH to the attacker’s address. Countdown started. ④ Day of the attack / Synchronously draining four chains The attackers used the node’s access to the Asgard vault to extract the protocol’s own liquidity across chains, with funds instantly dispersed. This was a meticulously planned long‑term infiltration.

Even the project team can’t detect such attacks in advance, and ordinary wallet users are even less likely to anticipate them. Once affected, they can cause substantial personal asset losses. However, there are several steps you can start taking now to protect your wallet assets: 1. Don’t keep tokens in cross‑chain protocol liquidity pools for the long term For protocols like @THORChain, the security surface is many times more complex than single‑chain systems, and liquidity providers are often the first to suffer losses. 2. Actively check the underlying route of DEX/aggregators Many aggregators automatically route through THORChain. Before initiating a swap, you can verify the routing path in the source reference. 3. Start with small tests, split large operations The larger and more complex the cross‑chain transaction, the more concentrated the risk in a single run, so avoid moving everything at once. 4. Pay more attention to the protocol’s history This security incident is the third major one for THORChain in the past five years; it was hacked for over $10 million in 2021, and in September 2025 the founder’s wallet was stolen of $1.2 million by North Korean hackers.

Since 2021, cross‑chain bridges and liquidity protocols have collectively lost over $2.8 billion. THORChain’s $10.8M loss is just another repetition of history... What was stolen this time was the protocol’s own funds (POL). Although @THORChain’s team preliminarily assesses that user funds were not directly affected, there’s still debate over whether LP positions can be fully isolated, and whether the bonded nodes can be slashed to cover the shortfall. The community has not reached consensus. Full network recovery may still take several days. The protocol you trust is secure. But the nodes it trusts are not necessarily safe. #TrustWallet #SAFU #Web3安全