hacked

Friday, May 15, 2026, decentralized cross-chain liquidity protocol THORChain was exploited for approximately $10.8 million, with the attack spanning four separate blockchains simultaneously. A wallet labeled by Arkham as the THORChain exploiter showed $10.8 million in holdings, transferred across several smaller transactions in the 30 minutes before 10:11 AM UTC.
Wallets linked to the attacker currently hold roughly 3,443 ETH, 36.85 BTC, and 96.6 BNB. The incident was first flagged by on-chain investigator ZachXBT on Telegram, prompting the protocol to immediately halt all trading and signing operations. $RUNE dropped over 6% after the initial alert, trading near $0.50, and ultimately fell around 13% following the suspected exploit, also now down 72% over the past year. As of this writing, THORChain has yet to publish a post-mortem identifying the specific attack vector
This is far from THORChain's first rodeo with exploits. Cross-chain bridges and liquidity protocols have historically been the most exploited category in DeFi, with over $2.8 billion in cumulative bridge-related theft since 2021 per Chainalysis. Today's breach is at least the third security incident for the protocol in recent years. The protocol's security troubles are compounded by its growing reputation as a conduit for illicit funds — the majority of the $1.4 billion stolen during the Bybit hack, or about $1.2 billion, was moved through THORChain by hackers, who swapped it from Ether to Bitcoin. Earlier in April, the attacker behind the $293 million Kelp DAO exploit swapped 75,700 ETH through THORChain, generating about $910,000 in revenue for the protocol itself. This creates a deeply uncomfortable reality: THORChain profits from crime, even when it isn't the direct target. Personally, this exploit is hard to be shocked by but it's still frustrating to watch. THORChain's core idea, native cross-chain swaps without bridges or centralized intermediaries, remains genuinely valuable and technically ambitious.
Just weeks ago, the protocol burned 64.4 million RUNE and launched a major v3.17.0 network upgrade with over 100 improvements focused on security, swaps, and cross-chain reliability. There's clearly a committed team building here. But the pattern is becoming undeniable: every time THORChain gains momentum, a new exploit drags it back down. At some point, "decentralized" can't be an excuse for "insecure."
The lack of a post-mortem hours after the attack is also telling transparency should be the first response, not an afterthought. If THORChain wants to be taken seriously as infrastructure for the broader DeFi ecosystem, it needs to treat security with the same urgency it treats innovation.$RIVER
#VitalikMovesETHviaPrivacyPools I #SolanaTreasuryQ1SPSUp108 I #PredictionMarketRisingCompetition I #StriveQ1Results15009BTCHoldings I #Hacked

This is the first recorded large-scale bot-on-bot attack in history. The incident took place on the Base network. It demonstrated that AI agents are completely vulnerable to classic text manipulation when real money is on the line.
An attack was carried out by a user on social network X with the handle @ilhamrafli.base.eth. The victims were the Grok model and the automated financial bot Bankrbot.

North Korean hackers have stolen cryptocurrency worth $2.837 billion from January 2024 to September 2025. Most of the funds are laundered through intermediaries in Russia, Hong Kong, and Cambodia, experts from the Multilateral Sanctions Monitoring Group on North Korea (MSMT) at the UN reported.
The main goal of hackers from North Korea, experts from the United Nations stated, is large centralized cryptocurrency exchanges. Cybercriminals have established close ties with Russian groups that are involved in the development of ransomware, representatives of MSMT said.