{"id":9153,"date":"2026-05-16T17:23:54","date_gmt":"2026-05-16T17:23:54","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=9153"},"modified":"2026-05-16T17:23:54","modified_gmt":"2026-05-16T17:23:54","slug":"thorchain-exploit-turns-defi-halt-into-trust-test","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=9153","title":{"rendered":"THORChain exploit turns DeFi halt into trust test"},"content":{"rendered":"<p><\/p>\n<div>\n<div class=\"magazine-post-box__preferred-source\">  <span class=\"cs-preferred-google-badge__text\">Make<\/span> <span class=\"cs-preferred-google-badge__brand\" aria-hidden=\"true\"> <img class=\"cs-preferred-google-badge__brand-mark\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/imgresize\/timthumb.php?src=https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/cryptoslate-icon.jpg&amp;w=26&amp;h=26&amp;q=75\" alt=\"CryptoSlate logo\" width=\"26\" height=\"26\" decoding=\"async\"\/><img class=\"lazyload cs-preferred-google-badge__brand-mark\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/imgresize\/timthumb.php?src=https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/cryptoslate-icon.jpg&amp;w=26&amp;h=26&amp;q=75\" alt=\"CryptoSlate logo\" width=\"26\" height=\"26\" decoding=\"async\"\/> <span class=\"cs-preferred-google-badge__brand-name\">CryptoSlate<\/span> <\/span> <span class=\"cs-preferred-google-badge__text\">preferred on<\/span> <img class=\"cs-preferred-google-badge__google-wordmark\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/google-logo.svg\" alt=\"Google logo\" width=\"48\" height=\"16\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload cs-preferred-google-badge__google-wordmark\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/google-logo.svg\" alt=\"Google logo\" width=\"48\" height=\"16\" decoding=\"async\"\/> <\/div>\n<p>THORChain\u2019s suspected multichain exploit and emergency halt on May 15 has turned into another DeFi security incident, and another test of cross-chain trust.<\/p>\n<p>Emergency controls moved through chain-specific halts, Halt All Trading, Halt Signing, Halt Chain Global, Halt Churning, and repeated global node-pause updates.<\/p>\n<p>One public alert described the likely exploit <span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">affecting\u00a0Bitcoin,\u00a0Ethereum, BSC, and Base, resulting in more than $10.7 million in losses<\/span>, revised from an earlier $7.4 million estimate.<\/p>\n<p>Another security estimate put the loss near $10 million, including 36.75 BTC and about $7 million across BNB Chain, Ethereum, and Base.<\/p>\n<p>The chain scope was later expanded in a TRM Labs assessment, which reported that the attacker drained more than $11 million across at least nine chains. Those chains included Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP, in addition to the initial four-chain framing. The figures may still move as the accounting is reconciled, but the available record points to a multichain infrastructure event touching several native-asset routes.<\/p>\n<p>The halt, therefore, carried consequences beyond THORChain. Cross-chain liquidity is supposed to make crypto feel more useful, liquid, and connected. Yet the same design that lets assets move between isolated networks can also compress the response window when something breaks.<\/p>\n<div class=\"cs-article-embed\">\n<div class=\"cs-article-embed__media\"> <img loading=\"lazy\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/kraken-wrapped-bitcoin-chainlink-1024x576.jpg\" alt=\"Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/kraken-wrapped-bitcoin-chainlink-1024x576.jpg\" alt=\"Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi<\/h3>\n<p>Kraken is rebuilding how Bitcoin moves through DeFi after the KelpDAO shock.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">May 15, 2026<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Liam &#8216;Akiba&#8217; Wright<\/span><\/p>\n<\/div><\/div>\n<p>In this case, DeFi&#8217;s promise of seamless routing ran straight into the need for an emergency stop.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-536636 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon.jpg\" alt=\"Detective investigating a DeFi exploit map with THORChain, Bitcoin, BNB, DOGE, and liquidity clues.\" width=\"1280\" height=\"720\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon.jpg 1280w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-300x169.jpg 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-1024x576.jpg 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-768x432.jpg 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-480x270.jpg 480w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-1200x675.jpg 1200w\" sizes=\"(max-width: 1280px) 100vw, 1280px\"\/><img loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter wp-image-536636 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon.jpg\" alt=\"Detective investigating a DeFi exploit map with THORChain, Bitcoin, BNB, DOGE, and liquidity clues.\" width=\"1280\" height=\"720\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon.jpg 1280w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-300x169.jpg 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-1024x576.jpg 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-768x432.jpg 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-480x270.jpg 480w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-investigation-cartoon-1200x675.jpg 1200w\" data-sizes=\"(max-width: 1280px) 100vw, 1280px\"\/><\/p>\n<h2>The Halt Became The Signal<\/h2>\n<p>The operational response is documented in the chain&#8217;s emergency framework. THORChain&#8217;s procedures describe network and chain halts as tools node operators can use when funds are at risk.<\/p>\n<p>Its architecture relies on Bifrost observation, vaults, and threshold-signature signing to move native assets across chains without wrapping them.<\/p>\n<p>Those controls can protect funds by stopping further activity. They also show that cross-chain infrastructure is a stack of observers, validators, vaults, signing logic, node operations, and emergency procedures.<\/p>\n<p>When that stack is tested, the market asks whether a single bug can be patched and whether the system can remain credible while the response itself disrupts routing.<\/p>\n<p>I think that distinction brings the THORChain incident into the broader DeFi story. Mature financial infrastructure is expected to fail safely, explain quickly, and restore confidence with a documented root cause.<\/p>\n<p>DeFi often moves faster than that standard. It ships integrations, new chains, and liquidity routes before users and institutions have a clear way to price the full operational risk.<\/p>\n<div class=\"cs-article-embed\">\n<div class=\"cs-article-embed__media\"> <img loading=\"lazy\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/04\/aave-kelpdao-hack-1024x576.webp\" alt=\"After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/04\/aave-kelpdao-hack-1024x576.webp\" alt=\"After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted<\/h3>\n<p>Aave\u2019s rsETH bad debt shows DeFi\u2019s next security crisis rests in broken assumptions across bridges, governance, collateral listings, and risk controls.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">May 10, 2026<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Gino Matos<\/span><\/p>\n<\/div><\/div>\n<p>A compact confidence ladder captures the current state of record:<\/p>\n<table>\n<thead>\n<tr>\n<th>Signal<\/th>\n<th>What is supported<\/th>\n<th>What remains unresolved<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Initial security alert<\/td>\n<td>Likely exploit across Bitcoin, Ethereum, BSC, and Base for more than $10.7 million.<\/td>\n<td>Final loss accounting and complete chain scope.<\/td>\n<\/tr>\n<tr>\n<td>Independent estimate<\/td>\n<td>About $10 million, including 36.75 BTC and roughly $7 million on EVM-linked chains.<\/td>\n<td>Whether all affected assets and addresses have been fully reconciled.<\/td>\n<\/tr>\n<tr>\n<td>Analytics scope<\/td>\n<td>More than $11 million across at least nine chains.<\/td>\n<td>How the wider scope maps to THORChain&#8217;s final postmortem.<\/td>\n<\/tr>\n<tr>\n<td>Emergency controls<\/td>\n<td>Trading, signing, global chain activity, and churning controls were activated.<\/td>\n<td>How quickly the halt contained the damage and what activity resumed afterward.<\/td>\n<\/tr>\n<tr>\n<td>Protocol confirmation<\/td>\n<td>One of six Asgard vaults was reportedly compromised for roughly $10.7 million; initial indications said individual swaps were unaffected.<\/td>\n<td>Final root cause, final user-impact accounting, and postmortem detail.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<figure id=\"attachment_536640\" aria-describedby=\"caption-attachment-536640\" style=\"width: 1001px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-536640 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e.jpeg\" alt=\"Infographic mapping THORChain's May 15 exploit scope against emergency halt controls and unresolved postmortem questions.\" width=\"1001\" height=\"1572\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e.jpeg 1001w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-191x300.jpeg 191w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-652x1024.jpeg 652w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-768x1206.jpeg 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-978x1536.jpeg 978w\" sizes=\"(max-width: 1001px) 100vw, 1001px\"\/><img loading=\"lazy\" decoding=\"async\" class=\"lazyload wp-image-536640 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e.jpeg\" alt=\"Infographic mapping THORChain's May 15 exploit scope against emergency halt controls and unresolved postmortem questions.\" width=\"1001\" height=\"1572\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e.jpeg 1001w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-191x300.jpeg 191w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-652x1024.jpeg 652w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-768x1206.jpeg 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a0839f3b71481919877253d9f3a588e-978x1536.jpeg 978w\" data-sizes=\"(max-width: 1001px) 100vw, 1001px\"\/><figcaption id=\"caption-attachment-536640\" class=\"wp-caption-text\">THORChain&#8217;s May 15 halt showed how suspected multichain losses, emergency controls, and unresolved postmortem questions converged into a broader DeFi infrastructure test.<\/figcaption><\/figure>\n<h2>The Trust Discount Is Now Measurable<\/h2>\n<p>The damage from exploits rarely ends with the drained wallet. Immunefi&#8217;s 2026 security findings put the average direct theft at $25 million, while the median loss fell to $2.2 million.<\/p>\n<p>That gap shows a market where routine defenses may improve while the largest incidents still define confidence.<\/p>\n<p>The same report found that the top five hacks in 2024 and 2025 accounted for 62% of stolen funds, and hacked tokens saw a median six-month decline of 61%.<\/p>\n<p>Those token moves cannot be cleanly separated from market conditions or project-specific weakness in every case. Still, the pattern supports the core market reaction: exploits become long-tail business events.<\/p>\n<p>They drain capital, consume team time, slow integrations, and make partners question whether the next failure will hit them indirectly.<\/p>\n<p>The trust discount reflects an extra layer of skepticism toward a sector that wants to be treated as financial infrastructure, yet still produces failures that look like crisis drills.<\/p>\n<p>Users, exchanges, market makers, custodians, and institutions require more evidence to trust a protocol&#8217;s uptime, monitoring, key management, and emergency processes.<\/p>\n<p>Recent cross-chain incidents reinforce that point. In the KelpDAO bridge exploit, attackers targeted off-chain verification and source-chain watching infrastructure rather than a conventional smart-contract bug.<\/p>\n<p>The result was a false view of reality that led to valid-looking transactions releasing funds. Bridge-security\u00a0<span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">fears have already influenced infrastructure decisions, including\u00a0Kraken&#8217;s move to use Chainlink CCIP for kBTC and future wrapped assets following<\/span>\u00a0the KelpDAO shock.<\/p>\n<div class=\"cs-article-embed\">\n<div class=\"cs-article-embed__media\"> <img loading=\"lazy\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/chainlink-ccip--1024x576.jpg\" alt=\"Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/chainlink-ccip--1024x576.jpg\" alt=\"Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero<\/h3>\n<p>More than $3 billion in DeFi value is moving toward Chainlink\u2019s CCIP after the KelpDAO exploit exposed weaknesses in bridge verification.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">May 11, 2026<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Oluwapelumi Adejumo<\/span><\/p>\n<\/div><\/div>\n<p>That makes the THORChain halt feel less isolated. The sector is being forced to prove that the trust path across chains is observable, redundant, and controllable before billions of dollars of liquidity are routed through it.<\/p>\n<p>For institutional users, the issue becomes operational due diligence. Cross-chain exposure touches custody policy, liquidity commitments, incident response, and counterparty reviews.<\/p>\n<p>A protocol that routes native assets across chains has to prove that the monitoring and emergency process around that routing is as strong as the connectivity itself.<\/p>\n<p>For builders, that changes what counts as progress. New routes and integrations can deepen liquidity, but they also create more surfaces for monitoring, key management, and incident response.<\/p>\n<p>The next credibility gains will come from showing that controls scale with liquidity before a failure forces counterparties to revisit assumptions.<\/p>\n<h2><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-536638\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f.jpeg\" alt=\"\" width=\"1000\" height=\"1573\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f.jpeg 1000w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-191x300.jpeg 191w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-651x1024.jpeg 651w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-768x1208.jpeg 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-976x1536.jpeg 976w\" sizes=\"(max-width: 1000px) 100vw, 1000px\"\/><img loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter size-full wp-image-536638\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f.jpeg\" alt=\"\" width=\"1000\" height=\"1573\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f.jpeg 1000w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-191x300.jpeg 191w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-651x1024.jpeg 651w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-768x1208.jpeg 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/ig_047607b55c0a8156016a083a33101c8191b8a9f2f47959d21f-976x1536.jpeg 976w\" data-sizes=\"(max-width: 1000px) 100vw, 1000px\"\/><\/h2>\n<h2>THORChain Carries A Compliance Layer Too<\/h2>\n<p>THORChain&#8217;s position is especially sensitive because the protocol combines an attack surface with a routing role in major illicit-flow episodes.<\/p>\n<div id=\"cs-inline-newsletter-6a08a7f620aeb\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\">CryptoSlate Daily Brief<\/span><\/p>\n<h3 class=\"cs-inline-newsletter__title\">Daily signals, zero noise.<\/h3>\n<p class=\"cs-inline-newsletter__copy\">Market-moving headlines and context delivered every morning in one tight read.<\/p>\n<p> <span><i class=\"fa-regular fa-bolt\" aria-hidden=\"true\"\/> 5-minute digest<\/span> <span><i class=\"fa-regular fa-star\" aria-hidden=\"true\"\/> 100k+ readers<\/span><\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__privacy\">Free. No spam. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span>You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<p>As of TRM&#8217;s report, the May 15 exploit had no public actor attribution. That caveat keeps the current incident separate from earlier laundering cases unless new evidence changes the record.<\/p>\n<p>The same analysis described THORChain as a recurring rail for moving stolen funds, including flows tied to the Bybit and KelpDAO incidents.<\/p>\n<p>That pressure was\u00a0<span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">evident after Lazarus-linked Bybit funds moved through the protocol, when THORChain faced\u00a0tensions between developers and validators<\/span>.<\/p>\n<div class=\"cs-article-embed\">\n<div class=\"cs-article-embed__media\"> <img loading=\"lazy\" width=\"1024\" height=\"538\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/01\/thorchain-rune-1024x538.jpg\" alt=\"Thorchain faces developer exodus amid North Korean money laundering scandal\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" width=\"1024\" height=\"538\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/01\/thorchain-rune-1024x538.jpg\" alt=\"Thorchain faces developer exodus amid North Korean money laundering scandal\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Thorchain faces developer exodus amid North Korean money laundering scandal<\/h3>\n<p>A core contributor known as TCB warned that Thorchain could face a crisis if the network is framed as a money laundering facilitator.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">Feb 28, 2025<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Gino Matos<\/span><\/p>\n<\/div><\/div>\n<p>Federal investigators attributed the February 2025 Bybit theft of about $1.5 billion in virtual assets to North Korea&#8217;s TraderTraitor activity.<\/p>\n<p>The FBI also urged private-sector crypto entities, including DeFi services and bridges, to block transactions to or from addresses linked to laundering.<\/p>\n<p>That history sharpens the current episode. A protocol can be useful because it makes native cross-chain swaps efficient. The same utility can make it attractive to attackers and difficult for compliance teams to ignore.<\/p>\n<p>Once a protocol is seen as both exploitable infrastructure and a route for illicit funds, counterparties have to price in more than just smart-contract risk.<\/p>\n<p>They have to price operational interruption, screening exposure, and the chance that integrations become reputational liabilities.<\/p>\n<p>RUNE price reaction stays secondary. Market data on May 16 put RUNE at around $0.44, down 21.90% over 24 hours.<\/p>\n<p>The broader crypto market stood near $2.61 trillion with Bitcoin dominance at 60.2%. The market noticed the incident, but the more important question is whether liquidity providers, routing interfaces, wallet integrations, and compliance desks change behavior after the halt.<\/p>\n<p>The important market signal will come from the next set of operational choices rather than from a one-day chart. Liquidity interfaces can route around protocols that introduce uncertainty; custodians and market makers can raise internal risk scores.<\/p>\n<p>Compliance teams can demand better screening and incident records before supporting integrations. Those reactions are slower than a token selloff, but they are the way a security event becomes a durable trust discount.<\/p>\n<p>That is the slower repricing institutions notice. It shows up in due diligence questions, integration queues, and risk limits long after the emergency halt leaves the alert feed.<\/p>\n<h2>The Next Test Is The Postmortem<\/h2>\n<p>The next test starts with more than a recovery message: THORChain needs to produce a clear postmortem, reconcile the final loss figure and chain count, explain the root cause without speculation, and show what changed in its vault, key-management, node, monitoring, and halt processes.<\/p>\n<p>Recovery details may help contain user harm while leaving the infrastructure question intact.<\/p>\n<p>If THORChain completes compensation, resumes safely, and documents a credible fix, the incident can remain a severe but contained confidence hit.<\/p>\n<p>If the root cause remains unsettled, final accounting keeps changing, or integrations pull back, the event becomes another data point in a broader repricing of cross-chain DeFi.<\/p>\n<p>That is the sector-level consequence. DeFi wants to present itself as a durable, always-on financial infrastructure.<\/p>\n<p>Every major cross-chain exploit makes that claim harder to defend until the industry can show that the bridges, vaults, signing systems, and emergency controls connecting its markets are as mature as the capital they aim to attract.<\/p>\n<\/div>\n<p>DeFi,Featured,Hacks,Market,Privacy,Scams#THORChain #exploit #turns #DeFi #halt #trust #test1778952234<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Make CryptoSlate preferred on THORChain\u2019s suspected multichain exploit and emergency halt on May 15 has turned into another DeFi security incident, and another test of cross-chain trust. Emergency controls moved through chain-specific halts, Halt All Trading, Halt Signing, Halt Chain Global, Halt Churning, and repeated global node-pause updates. One public alert described the likely exploit<\/p>\n","protected":false},"author":1,"featured_media":9154,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[593,664,4516,679,4515,355,912],"class_list":{"0":"post-9153","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-ethereum","8":"tag-defi","9":"tag-exploit","10":"tag-halt","11":"tag-test","12":"tag-thorchain","13":"tag-trust","14":"tag-turns"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>THORChain exploit turns DeFi halt into trust test - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"THORChain\u2019s suspected multichain exploit and emergency halt put DeFi\u2019s cross-chain trust model under pressure as losses, routing risk, and postmortem questions remain unresolved.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=9153\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"THORChain exploit turns DeFi halt into trust test\" \/>\n<meta property=\"og:description\" content=\"THORChain\u2019s suspected multichain exploit and emergency halt put DeFi\u2019s cross-chain trust model under pressure as losses, routing risk, and postmortem questions remain unresolved.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=9153\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-16T17:23:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=9153\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=9153\",\"name\":\"THORChain exploit turns DeFi halt into trust test - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=9153#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=9153#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg\",\"datePublished\":\"2026-05-16T17:23:54+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"THORChain\u2019s suspected multichain exploit and emergency halt put DeFi\u2019s cross-chain trust model under pressure as losses, routing risk, and postmortem questions remain unresolved.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=9153#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=9153\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=9153#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=9153#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"THORChain exploit turns DeFi halt into trust test\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"THORChain exploit turns DeFi halt into trust test - Crypto News: Latest Cryptocurrency News and Analysis","description":"THORChain\u2019s suspected multichain exploit and emergency halt put DeFi\u2019s cross-chain trust model under pressure as losses, routing risk, and postmortem questions remain unresolved.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=9153","og_locale":"en_US","og_type":"article","og_title":"THORChain exploit turns DeFi halt into trust test","og_description":"THORChain\u2019s suspected multichain exploit and emergency halt put DeFi\u2019s cross-chain trust model under pressure as losses, routing risk, and postmortem questions remain unresolved.","og_url":"https:\/\/cryptonews.uk.com\/?p=9153","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-05-16T17:23:54+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=9153","url":"https:\/\/cryptonews.uk.com\/?p=9153","name":"THORChain exploit turns DeFi halt into trust test - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=9153#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=9153#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg","datePublished":"2026-05-16T17:23:54+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"THORChain\u2019s suspected multichain exploit and emergency halt put DeFi\u2019s cross-chain trust model under pressure as losses, routing risk, and postmortem questions remain unresolved.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=9153#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=9153"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=9153#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/05\/thorchain-exploit-.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=9153#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"THORChain exploit turns DeFi halt into trust test"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/9153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9153"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/9153\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/9154"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}