THORChain Hit by $10.8M Cross-Chain Hack as RUNE Tumbles 15%, ZachXBT Finds

Published October 18, 2026, 02:20 PKT. Based on on-chain investigator ZachXBT's October 17, 2026 Telegram disclosure (primary source), Blockonomi's October 17, 2026 report citing Arkham Intelligence data (secondary source), and CryptoPotato's October 17, 2026 report of the disclosure (secondary source).

On-chain investigator ZachXBT said on October 17, 2026 that THORChain, the cross-chain liquidity protocol, had been hit by a new exploit across four blockchains. The attackers drained funds from the protocol's Bitcoin, Ethereum, BNB Chain and Base deployments, according to ZachXBT's Telegram post to his more than 100,000 followers, which was first carried by CryptoPotato. CryptoPotato put the loss at over $7.4 million; Blockonomi, citing Arkham Intelligence wallet data, put it at about $10.8 million. THORChain had not issued an incident report or post-mortem at the time of publication, and the exploit method remains unknown.

The four-chain exploit

Arkham Intelligence tracked wallets linked to the attacker and found the haul concentrated in three tokens. The wallets held 3,443 ETH worth about $7.77 million, making Ethereum the largest share of the stolen funds, according to Blockonomi. They also held 36.85 BTC worth about $2.97 million and 96.6 BNB valued near $66,000. Blockchain records showed coordinated transfers across multiple networks, with the attacker consolidating the assets into identifiable wallets after the breach, Blockonomi reported. ZachXBT said he was continuing to monitor the attacker wallets for movement and sharing updates through Telegram as the situation developed.

RUNE's 15% slide

RUNE, THORChain's native token, fell sharply within hours of the news spreading on X. The token traded above $0.58 before the disclosure and crashed to a two-week low of $0.50, a decline of about 15%, where it found some support, according to CoinGecko data cited by CryptoPotato. Market data showed a double-digit percentage decline during the session. The protocol paused trading and signing operations soon after the alert surfaced: ZachXBT wrote that the "trading halt and signing halt parameters" had switched to active, executed through THORChain's Mimir governance module, and on-chain data showed a node pause lasting about 12 hours and 42 minutes from block 26190429, Blockonomi reported.

No post-mortem yet

The team has not released a detailed post-mortem, and officials have not confirmed the specific exploit method, Blockonomi said. THORChain has not issued a formal incident report. The halt was the protocol's emergency response rather than a routine upgrade: trading stays suspended while node operators investigate, and churn activity was paused while the network evaluates remediation steps, the same pattern THORChain followed in its previous emergency stops. ZachXBT noted that the story was still breaking with few details confirmed, and more information was expected in the following hours.

A protocol with exploit history

This is not THORChain's first emergency stop. In May 2026 the protocol lost about $10.7 million in an exploit that investigators traced to key material leaked during signing ceremonies, after which the protocol shut itself down entirely to contain the incident. Even then it never blacklisted the attacker's addresses, and community discussion has since considered moving away from the GG20 TSS implementation that underpinned the signing workflow. The current halt repeats that playbook: a full network stop first, questions about the root cause second. THORChain operates as a decentralized liquidity protocol that lets users swap native assets between blockchains without wrapping or centralized bridges, so an exploit in its vaults strikes at the core of what the protocol does.

The Bitget refusal looms over recovery

The hack lands weeks after THORChain publicly refused to help Bitget recover from its own breach. On September 26, Bitget CEO Gracy Chen formally asked the protocol to deny service to wallets tied to the exchange's $387.5 million September hack; THORChain publicly refused on September 28, drawing a sharp line between an emergency network halt, which it has used before, and a selective address freeze, which it says it does not operate and has no intention of building. The refusal renewed the debate over how much responsibility permissionless infrastructure providers bear for funds moving through their systems after a hack elsewhere. With the protocol now on the other side of an exploit, the same question cuts the opposite way: what tools does it have to slow its own attacker, and which of those tools is it willing to use.

Cross-chain protocols stay repeat targets

Cross-chain protocols have faced repeated security incidents since 2021, and Chainalysis reports more than $2.8 billion in bridge-related theft since that year. THORChain's previous exploit also drew attention to the wider pattern: the protocol was reported to have been hit by an exploit for the second time in two weeks in mid-2026-era reporting, underscoring how attractive cross-chain vaults remain to attackers. For now, the open questions are the ones THORChain has not yet answered: which vaults were drained, how the attacker got past the network's signing safeguards, and how long trading stays paused while the team finds out.

This article is news reporting and is not investment advice.

Sources

• On-chain investigator ZachXBT's Telegram disclosure, October 17, 2026, primary source: THORChain exploited across Bitcoin, Ethereum, BNB Chain and Base; loss estimated over $7.4 million; alert to 100,000-plus Telegram followers; "trading halt and signing halt parameters" switched to active; continuing to monitor attacker wallets for movement
• Blockonomi, October 17, 2026, secondary source: estimated loss about $10.8 million; Arkham Intelligence data showing attacker wallets hold 3,443 ETH worth about $7.77 million, 36.85 BTC worth about $2.97 million and 96.6 BNB valued near $66,000; halt executed through the Mimir governance module; node pause of about 12 hours and 42 minutes from block 26190429; team has not released a detailed post-mortem and has not confirmed the specific exploit method
• CryptoPotato, October 17, 2026, secondary source: first report of ZachXBT's Telegram disclosure; loss over $7.4 million; RUNE fell about 15% from above $0.58 to a two-week low of $0.50 where it found support, per CoinGecko data; no official confirmation from THORChain's team at the time of publication
• THORChain's September 28, 2026 public response, context: protocol refused Bitget CEO Gracy Chen's September 26 request to deny service to wallets tied to the $387.5 million September hack; emergency network halt is a security mechanism, not a selective freeze; protocol never blacklisted attacker addresses even during its own May 2026 $10.7 million exploit; questions the responsibility of Bitcoin, Ethereum and BNB Chain for processing known stolen assets
• Chainalysis, context: more than $2.8 billion in bridge-related theft since 2021