ZachXBT Flags Possible THORChain Multi-Chain Exploit; Trading Halt Triggered as RUNE Drops

Exploit claim spans multiple blockchains

Blockchain investigator ZachXBT said THORChain was likely affected by a multi-chain exploit involving Bitcoin, Ethereum, BNB Chain (BSC), and Base. According to his posts, the protocol may have suffered losses exceeding $10 million across the listed networks.

Initial messages circulating online placed the suspected loss above $7.4 million, but ZachXBT later updated his estimate, stating his revised accounting showed at least $10 million stolen. He indicated the figure was still subject to confirmation through continued on-chain tracking.

ZachXBT also disputed a third-party post that shared the alert, arguing it lacked proper sourcing and verification. He wrote, “Can tell because they did not check the numbers themselves / chains listed,” signaling concern that details were being amplified without independent validation.

THORChain initiates emergency measures

After the exploit claims spread, THORChain paused trading and implemented a global emergency halt across the network, based on community alerts shared in response to the situation. The action reduced activity while teams assessed the reported losses and reviewed potentially affected routes.

THORChain’s security documentation describes a HaltTrading setting as a network-level control that stops trading and observations across connected chains. The documentation notes that, under this setting, the THORChain blockchain itself can continue operating and native RUNE transactions can still proceed. The same material characterizes the mechanism as an emergency control available to nodes.

RUNE reacts as market awaits more clarity

The warning and subsequent halt coincided with a sharp move in RUNE, THORChain’s native token. Following ZachXBT’s alert, RUNE fell by roughly 15% within minutes, sliding from above $0.58 to near $0.50 as traders reacted to the developing situation and awaited clearer confirmation from protocol operators.

Market data cited by Crypto.news showed RUNE at $0.58 at press time, alongside 24-hour trading volume of $32.46 million and a market capitalization of about $204.88 million, before the most recent decline was fully reflected across trackers. The token remained down more than 70% over the past year.

Prior scrutiny tied to exploit-related fund flows

The latest alert arrives as THORChain has faced earlier scrutiny connected to the movement of funds associated with major DeFi attacks. In April, Crypto.news reported that assets linked to the approximately $290 million Kelp DAO exploit were routed through THORChain and Umbra.

In that episode, attackers moved about $175 million in ETH across new wallets, a flow that highlighted the challenges investigators and victims face when stolen assets are transferred through cross-chain infrastructure. The report underscored how multi-chain routing can complicate tracking and recovery efforts once funds begin moving between networks.

Crypto.news also previously reported that ZachXBT criticized Circle over its handling of funds connected to the $285 million Drift Protocol hack. That criticism contributed to a broader debate within the industry over how quickly crypto firms should respond when large-scale exploits occur.

Ongoing verification

ZachXBT’s latest estimate and the ensuing network actions left users monitoring official updates for firmer detail on the scope of the alleged exploit across Bitcoin, Ethereum, BSC, and Base. His comments indicated the loss estimate remained active pending additional on-chain confirmation, while THORChain’s emergency controls limited trading activity during the review period.