THORChain's Recent Security Incidents: Multi-Million Dollar Losses and RUNE Price Volatility
THORChain, as a decentralized cross-chain liquidity protocol, aims to facilitate seamless exchanges between assets on different blockchains. However, its development journey has been accompanied by multiple security challenges. The most recent major security incident occurred in May 2026, resulting in the theft of millions of dollars in assets and triggering significant price volatility for its native token, RUNE.
May 2026 Major Security Incident: TSS Vulnerability and Compensation Measures
On May 15, 2026, the THORChain network suffered a sophisticated attack where attackers exploited a vulnerability in its GG20 Threshold Signature Scheme (TSS) implementation. Preliminary investigations revealed that the vulnerability led to the gradual leakage of vault key material, ultimately allowing attackers to reconstruct private keys and execute unauthorized transactions. This attack resulted in approximately $10 million to $11 million in asset losses, including about 36.75 Bitcoin (valued at approximately $3 million) and approximately $7 million in assets on the Ethereum, BNB Chain, and Base networks.
The THORChain team responded swiftly upon detecting abnormal behavior, pausing transactions and outbound signing activities within 8 minutes to minimize losses. Initially, the THORChain Foundation stated that only the protocol's own funds were affected, and user funds were secure. However, a $10 million compensation pool was subsequently established on May 16, 2026, and a compensation portal was launched to provide a claims process for the 12,847 affected wallets. The compensation window closed on June 4, 2026, with unclaimed funds being transferred to the protocol's insurance fund. After approximately five weeks of suspension, THORChain resumed trading, swaps, and liquidity provider operations on June 23, 2026. Following the attack, THORChain also issued a warning, reminding users to be wary of fake refund, airdrop, and compensation schemes impersonating the official team.
This attack had a significant impact on the price of the RUNE token. Within hours of the incident, RUNE's price dropped by over 14% (with reports ranging from 12% to 15%), falling to around $0.50 at one point. On-chain detectives like ZachXBT and security firms such as PeckShield were among the first to identify and report the abnormal activity and losses.
Historical Security Incidents and Cumulative Losses
In addition to the May 2026 incident, THORChain has experienced multiple security challenges in the past:
- Two Attacks in July 2021: In July 2021, THORChain suffered two attacks. In the first attack, attackers exploited a vulnerability in Bifrost (the Ethereum bridge) to steal approximately $4.9 million in tokens from liquidity pools. A subsequent second attack saw attackers claiming to aim to "teach THORChain developers a lesson." During these attacks, the price of the RUNE token fell from $7.61 to below $4. The THORChain community acted quickly, releasing patches, restarting the network, and collaborating with security firms like Halborn for audits.
- Founder's Wallet Hacked: In 2025, THORChain founder JP Thorbjornsen's personal wallet was attacked by suspected North Korean hackers, resulting in a loss of $1.2 million.
Cumulatively, since 2021, THORChain-related theft incidents, including the founder's personal wallet hack, have amounted to nearly $25 million in losses.
Money Laundering Controversy and Decentralization Debate
Due to its "permissionless" cross-chain nature, THORChain has also sparked controversy regarding its role in money laundering activities. Institutions such as TRM Labs have reported that THORChain has become a preferred bridge for entities like North Korean hackers to launder funds, involving cross-chain transfers of stolen funds from major hacks such as Bybit (2025, $1.5 billion), KelpDAO (April 2026, approximately $300 million), and Bitget (September 2026, approximately $387.5 million).
In response to calls from exchanges like Bitget to block attacker addresses, THORChain stated that it is decentralized and permissionless, similar to networks like Bitcoin, Ethereum, and BNB Chain, and questioned what responsibility these networks should bear when dealing with known stolen funds. This stance has sparked a broad discussion within the industry regarding the responsibilities of decentralized protocols in the face of illicit activities.
