THORChain halts trading after a compromised Asgard vault drains $10.7M from protocol funds.
Security & Exploits ·
THORChain suspended trading after one of six Asgard vaults was compromised, resulting in an estimated $10.7 million loss from protocol-owned funds. The network's automated systems detected the abnormal behavior and halted signing activity, preventing additional outbound transactions before the broader community was alerted. User funds remain unaffected according to initial findings, though the investigation into the root cause is ongoing.
The compromise triggered automatic safeguards that slashed bonded RUNE from nodes securing the affected vault. In response, the network has paused churn activity—the process of rotating validator sets—delaying operations that require chain additions until stability is restored. Onboarding of new chains is also postponed during remediation.
Key questions remain unanswered: the precise mechanism of the compromise, whether any individual node operator infrastructure was targeted, and the timeline for resuming normal operations. THORChain has asked all node operators to audit their security systems and report suspicious activity, while those managing the affected vault are being requested to provide detailed logs for analysis.