On May 15, 2026, THORChain was once again pushed into the spotlight. Multiple media outlets cited on-chain analysts stating that this decentralized cross-chain liquidity protocol faced attacks on several chains, with initial losses estimated to exceed $7.4 million. As the news spread, THORChain opted to hit the "pause button," announcing a suspension of trading to prevent more assets from being operated on or further stolen in an unsafe state before the unknown attack paths and causes were clarified. According to public market data, RUNE's price accelerated its decline amid the sell-off, once dipping below 0.5 USDT, with a 24-hour drop of about 10%-12%. Some platforms quoted prices around $0.515 during the day; subsequently, as the sell pressure eased, the price rebounded to about 0.52 USDT, reflecting a shift in market sentiment from short-term panic to cautious observation. However, by later that day, specific technical details and causes of the attack were still lacking a detailed, widely cited official technical review, tightening the community's trust, which was already strained due to several historical security events. Next, we will follow the on-chain context of this attack to discuss how it shakes the market's trust in THORChain and the entire cross-chain protocol space.

Multi-chain Breached: THORChain's Defenses Exposed Again

Prior to this incident, THORChain had operated as a decentralized cross-chain liquidity protocol for years, emphasizing the narrative of "direct asset exchange between multiple blockchains," but it had also been labeled "high risk, high reward" due to various security-related incidents. Cross-chain transactions are already viewed as one of the weakest links in DeFi; the complexity of routing logic, cross-chain messaging, and external dependencies stretched THORChain's security boundaries, making each incident feel like another fingerprint pressed into existing cracks.

On May 15, 2026, this long chain was broken again. On-chain detective ZachXBT disclosed on social media that THORChain was attacked on multiple chains, with losses reported by multiple media as exceeding $7.4 million. The phrase "multi-chain attack" was quickly adopted and amplified by Jinse Finance, Odaily Planet Daily, and others. Faced with sudden risks, THORChain announced a suspension of trading, using an "emergency brake" to prevent more assets from circulating in a potentially unsafe state. However, by later that day, the only information available to the outside world was a rough loss figure—there was no clear confirmation from authoritative sources on which chains were affected, which assets were breached, or what specific technological paths were exploited. This information vacuum, combined with past incidents, raised doubts in the market about whether THORChain's defenses were genuinely solid, proving more damaging than the numbers themselves.

ZachXBT's Disclosure Amplifies Crisis Narrative

Just as the official side was still "assessing losses," this information vacuum was first filled by on-chain detective ZachXBT. Multiple public materials indicated that on May 15, 2026, ZachXBT was the first to disclose on social media that THORChain suffered an attack on multiple chains, with losses exceeding $7.4 million; this statement was quickly cited by numerous media outlets as the starting point of the incident narrative. Reporting from Jinse Finance and Odaily Planet Daily not only cited ZachXBT's conclusion but also used keywords like "multi-chain attack" and "loss exceeding $7.4 million" in their headlines, swiftly packaging an event that was still relegated to a technical incident into a public crisis of “cross-chain protocol failing again.”

To readers accustomed to tracking on-chain attack events, ZachXBT is no stranger. As an independent analyst who has long published on-chain evidence, he has repeatedly influenced community judgment by tracking addresses and restoring funding paths during similar incidents, and this accumulated "credibility" tends to amplify in moments of panic. This disclosure coincided with RUNE's severe fluctuation of 10%-12% on the same day, with media embedding his conclusions while reporting the price drop, leading the impression of "THORChain multi-chain attacked, losses exceeding ten million dollars" to spread far ahead of the technical details. In the absence of an official technical review, on-chain security analysts and media effectively co-led the market's first emotional script regarding this incident.

RUNE's 10% Plunge and Recovery: Emotionally Frozen then Warmed Up

Following this “incident script,” the price provided the most intuitive emotional curve. According to Foresight News, within the 24 hours during which the "multi-chain was attacked" and trading suspension news simultaneously fermented, RUNE dropped approximately 10.88%, piercing down to about 0.5 USDT; Deep Tide TechFlow, citing HTX market data, reported a drop exceeding 12%, settling around $0.515. While THORChain protocol opted to hit the pause button, this did not prevent RUNE from being immediately sold off on centralized exchanges, continuously declining and dropping to around $0.5, reflecting a panic-driven pricing response to "the protocol has another security issue" rather than a calm assessment of the loss scale and technical causes.

What is truly noteworthy is what happened after this "long lower shadow." Multiple market data sources indicated that RUNE, after piercing below $0.5, did not evolve into an endless sell-off; instead, it quickly stabilized and partially rebounded in the $0.5-$0.52 range, regaining about $0.52 USDT. This suggests that some participants, after venting panic, chose to stop the decline and wait and see, rather than directly declaring the project "dead." This pattern of first plunging and then recovering resembles a short-term emotional repair after a severe blow to safety trust, rather than signaling that the market has definitively recognized risk as cleared and is re-awarding THORChain a full premium.

How an Incident Reshapes Credit for Cross-Chain Protocols

As the shadows of multiple past security events have yet to disperse, THORChain was once again exposed to attacks on multiple chains. This series of records put it under scrutiny regarding "the reliability of its security architecture." Cross-chain bridges and cross-chain liquidity protocols are already regarded as among the riskiest areas in DeFi, with a history of frequent attacks. To directly facilitate asset matching between multiple chains and improve user experience and efficiency, THORChain has, inevitably, stacked complex routing logic and cross-chain components, making it easier for outsiders to interpret this incident as yet another affirmation that "system complexity traded functionality but amplified attack surfaces." After the incident, the protocol side opted to pause trading to halt further losses, interpreted as a decision of "safety coming before usability." However, under the decentralized narrative, such emergency brakes will similarly be questioned: who truly holds the underlying authority boundaries, and under what conditions might this button be pressed again in the future?

In a phase where the technical causes of the attack and improvement measures have not been publicly and transparently disclosed, participants appear to be self-protecting on a "battlefield of information scarcity." Liquidity providers typically first assess their own exposure, not ruling out discounting uncertain risks by reducing positions, shortening participation periods, or diversifying to other protocols; integrators would re-evaluate the necessity of integrating user assets into THORChain, leaning toward temporarily taking down related entry points or lowering default weights to avoid additional reputational costs for collaboration; meanwhile, ordinary users, having reached a preliminary consensus on the scale of losses but unclear on specifics, mostly choose to wait, reducing the frequency of cross-chain exchanges and avoiding large operations, handing "decision-making power" over to time and subsequent disclosures. Whether THORChain can ultimately provide a market-recognized technical review, a clear reinforcement roadmap, and a bounded recovery plan will directly determine whether this incident is recorded in history as “another incident” or as “the starting point of credit reconstruction.”

Following this Attack, What Signals to Watch Next

This widely reported multi-chain attack, with losses exceeding $7.4 million, combined with RUNE's sharp drop of about 10%-12% within 24 hours of the news's fermentation and once falling below 0.5 USDT, has pushed THORChain's security controversy and "high risk, high reward" label back to the forefront, posing substantial impacts on its brand image and the risk preferences of existing and potential users. In the short term, the primary focus should be on the official review: as of May 15, 2026, there has yet to be a detailed technical review report widely cited; whether the follow-up can adequately clarify attack paths, internal risk control gaps, and responsibility divisions in a reasonable timeframe will be the first test of its attitude; the second dimension is the rhythm of repair and recovery—the protocol has taken emergency measures like suspending trading, and when and under what safety premises various chains and types of assets will be restored step by step will directly influence users’ willingness to engage in cross-chain exchanges again; the third dimension pertains to actions at the on-chain and protocol level—if there are future substantive changes such as contract upgrades, additional audits, or community governance proposals, their transparency, execution strength, and community feedback will together constitute a "behavioral trajectory," determining whether THORChain, after a loss exceeding $7.4 million, will be conclusively branded by the market as another example of security black history or cautiously regarded as a starting point for regaining trust.

Join our community for discussions and to grow stronger together!
Official Telegram community: https://t.me/aicoincn
AiCoin Chinese Twitter: https://x.com/AiCoinzh
AiCoin on-chain: https://aicoin.com/hyperliquid
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。