THORChain Loses Over $10 Million in Cross-Chain Exploit, Halts Trading as RUNE Falls 12%

THORChain is a decentralized liquidity protocol that lets users swap native assets such as Bitcoin across blockchains without wrapped assets or centralized intermediaries. Its assets are jointly managed through Asgard vaults and network nodes. If a single malicious node gains vault-signing authority, it can endanger protocol funds and expose systemic risks in the GG20 threshold-signature mechanism.

On May 15, 2026, a malicious node exploited a GG20 vulnerability to steal about $10.7 million from an Asgard vault, affecting Bitcoin, Ethereum, BNB Chain and Base. The protocol shut down completely, and RUNE fell 12%. After completing security upgrades, vault migrations and key verification, THORChain restored the network on June 22 and announced on June 23 that trading, signing and liquidity operations had fully resumed.