THORChain Exploit Drains Over $10M Across Three Chains
An attacker drained over $10 million from THORChain in an exploit that touched Bitcoin, Ethereum, and BSC. If you routed funds through THORChain bridges around the incident window, this is the event to check against your transaction history.
The Exploit
The attacker abused the protocol itself, not any one chain it connects. That's what makes THORChain incidents different from a single-chain hack. Value moved across Bitcoin, Ethereum, and BSC because THORChain's job is to move value across those chains, and the exploit rode the same rails.
For users, the visible symptoms are downstream: swaps that stuck mid-route, expected output that never arrived, balances that don't match what the interface promised. The theft happened at the protocol layer. The pain showed up at the wallet layer.
Why Cross-Chain Is The Target
Bridges and cross-chain swap protocols have been the highest-value attack surface in crypto for years. The reason is structural. A single-chain swap has one set of contracts to secure. A cross-chain route has contracts on each chain, a messaging layer between them, and liquidity pools that have to stay solvent through every hop. Each piece is a target. THORChain has been hit before. So has nearly every major bridge.
The lesson isn't that THORChain is uniquely unsafe. It's that any protocol moving value across chains carries a different risk profile than a swap on a single network, and users routing real money through them should price that in.
What To Watch For
- Stuck or failed routes in the incident window: If a swap initiated and the output never arrived, document the transaction hashes on both source and destination chains before the interface clears them.
- Recovery scams: Big exploits attract fake "recovery agents" within hours. Anyone asking for wallet approvals, seed phrases, or a deposit to release funds is the second attack, not the cure.
- Official protocol comms only: Wait for verified statements from THORChain before signing anything new. Spoofed accounts and lookalike domains spike during incidents.
- Approvals still live on your wallet: If you granted token approvals to THORChain router contracts, review them and revoke what you don't need. Approvals outlive the swaps that created them.
- Post-incident token launches: "Reimbursement tokens" and impostor recovery projects often appear after exploits. Treat any unsolicited airdrop tied to the incident as bait.
See the live risk profile: isthiscoinascam.com/check/thorchain