THORChain Hit by $10M Multichain Exploit Across 4 Networks

Another major DeFi protocol has been hit. THORChain, the decentralized cross-chain liquidity protocol, suffered a multichain exploit on May 15, 2026. The losses are now confirmed at over $10 million. Blockchain investigator ZachXBT first identified and reported the attack. He corrected an early estimate of $7.4 million upward after completing his own on-chain accounting. The protocol responded by executing a global emergency halt, pausing all trading across the network. Crypto hack news today adds THORChain to a growing list of cross-chain protocols breached in 2026.

What Happened and How ZachXBT Found It

The story broke when another account posted early intel about the exploit, crediting themselves as the source. ZachXBT corrected the record directly. “Think you meant to say: Source of intel is ZachXBT’s Telegram Channel,” he posted, before adding the more significant update. “I finished accounting again now, and it looks to be $10M+ stolen at least.”

The exploit targeted THORChain’s Asgard vaults across four separate networks simultaneously: Bitcoin, Ethereum, BSC, and Base. That multichain scope is what makes this attack particularly notable. Coordinating a simultaneous drain across four separate blockchain networks requires significant technical sophistication and advance preparation.

On-chain data linked to the attack shows a BTC address holding approximately 36.85 BTC and an Ethereum address containing roughly 216 ETH plus additional BNB positions. ZachXBT’s community alert identified the primary theft addresses: bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37 on Bitcoin and 0x82fc0d5150f3548027e971ec04c065f3c93154eb on Ethereum. This enabled the community to begin tracking fund movements immediately.

THORChain’s Response

The protocol paused trading and executed a global emergency halt across the network following ZachXBT’s alert. That response speed matters. Rapid protocol-level intervention limits additional damage once an exploit is identified. It’s a lesson the DeFi industry has learned from slower responses in prior incidents.

THORChain has faced security scrutiny before. The protocol has also appeared repeatedly as a routing layer in fund movements connected to other exploits. Which are most notably as a laundering path used by the Lazarus Group following the Bybit hack. Thursday’s incident marks the first time THORChain itself appears to be the primary victim rather than an intermediary.

What This Means for Investors and Developers

For crypto news today followers and DeFi investors, THORChain’s exploit highlights a persistent vulnerability class. Cross-chain liquidity protocols that aggregate assets across multiple networks present attackers with a high-value. It complex target where a single exploit can drain funds across four chains simultaneously.

For developers building cross-chain infrastructure, the THORChain hack reinforces the security lessons emerging from 2026’s string of bridge and multichain exploits. The KelpDAO LayerZero breach, the Drift Protocol admin key compromise, and now THORChain’s Asgard vault attack all point to the same conclusion. That multichain attack surfaces require multichain security architectures, not single points of trust managing assets across multiple networks. 

ZachXBT’s rapid identification and public attribution once again demonstrated that on-chain transparency. While it cannot prevent exploits, it can limit their aftermath significantly.

The post THORChain Hit by $10M Multichain Exploit Across 4 Networks  appeared first on Coinfomania.