THORChain stopped. The cryptocurrency sector serves once again a hacker hunting ground. The THORChain protocol has just been targeted by a large-scale attack, which resulted in the misappropriation of more than 10 million dollars. To limit the damage, the team chose the radical measure: temporarily freeze all operations.
The key points of this article:THORChain was the victim of a major attack, resulting in the misappropriation of over $10 million.
To stem losses, the protocol temporarily suspended all operations using the Mimir governance module.
THORChain hacked for $10 million
Friday May 15, the THORChain teams announced in the press pausing the protocol following a large-scale attack. According to the elements shared by the researcherss safe from PeckShieldthe offensive affected several blockchains, including Bitcoin, Ethereum, BNB Smart Chain and Base. The total damage is estimated at more than 10 million dollars. The addresses identified by PeckShield indicate that the attacker has at this point:
3 443 ETHor approximately $7.77 million;
36,85 BTCor approximately $2.97 million;
96,6 BNBor approximately $66,000. To stop the bleeding, THORChain activated the governance module Mimirwhich allows freeze all operations trading and signing. The objective is clear: turn off the tap before the attacker siphons off more funds.
News of the attack has already made the rounds in specialized editorial offices – Source: Compte
Cross-chain bridges are recurring targets for hackers
The protocol is not at his first industrial accident. In January 2025, THORChain had already suspended its ThorFi loan operations amid allegations of insolvency. A 90-day restructuring plan followed, to try to settle a debt of 200 million dollars. Then in September 2025, THORChain co-founder John-Paul Thorbjornsen (JP Thor) fell victim toa sophisticated phishing attack which resulted in the theft of approximately $1.2 million to $1.35 million from his personal wallet. THORSwap, the aggregation platform backed by the protocol, then offered a bounty to try to recover the funds. The hacker had notably used THORChain to move part of the stolen assets via des swaps cross-chain. This type of use is not isolated: THORChain is frequently used by malicious actors as a cross-chain “laundering corridor”, to the point that the protocol regularly appears in analyzes of illicit flows published by Chainalysis and Elliptic. Finally, THORChain is not alone on the list of recent victims. The Drift protocol, specializing in the trading of perpetuals on Solana, also suffered a resounding attack last month, with damage estimated at several hundred million dollars. A reminder that cross-chain DeFi, despite its displayed maturity, remains a high-risk area for those who deposit their capital there.