THORChain — a crypto-swapping protocol widely used by cybercriminals to move and launder stolen funds — has now become a victim itself, losing more than $11 million in digital assets. GetBlock AML Research breaks down what is currently known about the attack.

Key Takeaways

• On May 15, 2026, an unknown attacker stole more than $11 million in cryptocurrency through THORChain. The exploit affected multiple blockchain networks, including Bitcoin, Ethereum, Binance Smart Chain (BSC), Base, Avalanche, DOGE, Litecoin, Bitcoin Cash, and XRP.
• Including previous exploits and attacks tied to the project — among them an incident involving THORChain founder JP Thorbjornsen — total losses connected to the ecosystem since 2021 are now close to $25 million.

THORChain Remains a Prime Target for Hackers

THORChain is a decentralized cross-chain liquidity protocol that allows users to swap assets between blockchains without wrapped tokens or centralized intermediaries. That same feature has made the platform both popular among users and attractive to cybercriminals.

On May 15, the attacker reportedly compromised THORChain-related functions across at least nine supported networks and drained funds from several blockchains almost simultaneously.

Cross-chain attacks like this are especially difficult to investigate. Funds can move across multiple networks faster than blockchain analytics systems can trace their origin and connect related transactions. That speed is one reason THORChain has remained a key tool in large-scale laundering operations for years.

Movement of stolen assets across networks. Source: TRM Labs

After draining the funds, the attacker redistributed the stolen crypto across Bitcoin, Ethereum, BSC, and Base before consolidating the assets into two primary wallets.

Why THORChain Continues to Spark Controversy

THORChain has faced multiple security incidents over the years. In July 2021 alone, the protocol suffered two major hacks. In 2025, founder JP Thorbjornsen was also reportedly targeted by suspected North Korean hackers. With the latest exploit, cumulative losses tied to THORChain-related attacks are now nearing $25 million.

The Problem Goes Beyond the Hacks

Over the past several years, THORChain has increasingly been linked to laundering operations involving stolen cryptocurrency from major cyberattacks.

The protocol was heavily associated with fund movements following the record-breaking $1.5 billion Bybit hack in 2025, as well as the recent KelpDAO exploit that resulted in nearly $300 million in losses.

Critics argue that THORChain’s leadership has consistently refused to block illicit transactions, citing support for transaction freedom and resistance to censorship within blockchain networks.

The same cross-chain infrastructure that makes THORChain attractive to legitimate users also makes it highly effective for rapidly moving stolen assets between blockchains.

Today, THORChain is increasingly viewed both as a potential attack surface and as infrastructure capable of facilitating illicit crypto flows.

For crypto exchanges and financial platforms, that means any transactions connected to THORChain are now widely considered higher risk — especially given the possibility that such transfers may involve funds from recent hacks or broader criminal activity.