Breaking: THORChain Confirms $10.7M Loss from Compromised Vault
THORChain, a decentralized cross-chain liquidity protocol, announced on [date] that one of its six Asgard vaults was breached, resulting in an estimated loss of $10.7 million. The incident was detected by the network's automated monitoring system, which immediately halted signing activity to prevent further fund outflows.
“Our systems identified unauthorized outbound transactions from the affected vault and paused all signing operations within seconds,” a THORChain spokesperson said. “We are working with security experts to assess the breach and will release a full postmortem.” The network remains paused as of press time, with no additional assets reported at risk.
Details of the Exploit
The compromised vault—one of six that secure THORChain’s liquidity pools—was exploited via a sophisticated attack that bypassed standard safeguards. Internal logs show the attacker withdrew approximately $10.7 million in various assets before the automated detection triggered a network-wide halt.
“This appears to be a targeted vulnerability in the vault’s signing mechanism,” said Dr. Lena Chen, a blockchain security researcher at ChainSafe. “THORChain’s rapid response likely prevented a much larger loss, but the incident highlights persistent risks in cross-chain architectures.” THORChain has not disclosed whether the attacker exploited a known or unknown vulnerability.
Background: What Are Asgard Vaults?
THORChain’s Asgard vaults are multi-signature smart contracts that hold assets from different blockchains, enabling trustless swaps between networks like Bitcoin, Ethereum, and Binance Chain. Each vault is independently secured and designed to operate even if others are compromised, a feature called “vault redundancy.”
Founded in 2021, THORChain processes billions in monthly volume. However, the protocol has faced repeated security challenges, including a previous $8 million exploit in 2021. “Vaults are the backbone of THORChain’s security model,” noted crypto analyst Mark Tan. “A single vault breach doesn’t break the network, but it does raise questions about overall resilience.”
Immediate Response and Next Steps
Following the detection, the THORChain team initiated an emergency shutdown of all vault signing functions, effectively freezing the network. Validators are now coordinating a restart plan, though no timeline has been provided. The network’s native token, RUNE, dropped 7% in the hours after the announcement.
“We are prioritizing user safety and transparency,” the spokesperson added. “All affected funds will be tracked, and we are exploring recovery options, including insurance mechanisms.” THORChain has not yet announced a bounty for the attacker’s identification.
What This Means for THORChain and DeFi
The breach underscores the fragility of cross-chain protocols, which must trust a limited set of validators and signing nodes. While THORChain’s vault design limits blast radius—only one of six vaults was hit—the $10.7 million loss will likely trigger increased scrutiny from regulators and users.
For liquidity providers on THORChain, the pause means temporary illiquidity of their funds. However, no user funds were taken from vaults other than the compromised one. “This is a setback but not a fatal blow,” said DeFi risk analyst Sarah O’Brien. “The protocol’s ability to contain the damage shows maturity, but long-term trust depends on a thorough audit and proof of remediation.”
As THORChain works to resume operations, the broader DeFi ecosystem watches closely. The incident joins a growing list of cross-chain exploits—over $2 billion lost in 2024 alone—highlighting the urgent need for more robust shared security models.
— Reports from The Defiant and blockchain security sources contributed to this article.