THORChain Restarts Trading After $10.7M Vault Exploit Without New RUNE Mint

THORChain has resumed trading after more than a month offline, restoring swaps and core network functions following the May 15 exploit that drained roughly $10.7 million from a single vault.

The protocol said trading is live again, with signing, churning, secured and trade assets, liquidity-provider actions, and swaps back online. The restart reopens one of crypto’s largest native cross-chain liquidity networks after a security incident that forced node operators to pause activity while vaults, keyshares and recovery accounting were reviewed.

The return is not a simple reopen after downtime. THORChain’s restart follows a recovery path built around loss absorption, vault verification and staged restoration rather than a quick liquidity patch. The protocol’s May 20 exploit report said the attack drained approximately $10.7 million from one vault out of five, while the remaining four vaults were unaffected.

The incident had already become a key DeFi security case because THORChain routes native assets across chains rather than relying on wrapped tokens. That model gives traders direct cross-chain liquidity, but it also concentrates operational risk around vault control, node coordination and signature security.

Single Vault Drain Triggered Emergency Controls

The May 15 attack was tied to THORChain’s GG20 Threshold Signature Scheme, the system used to coordinate vault signing across independent node operators. THORChain said the attacker was a newly churned node operator that entered the network two days before the exploit and used the vulnerability to reconstruct key material for one vault.

Automatic solvency checks detected the imbalance within minutes and halted signing and trading across multiple chains. Node operators then stacked manual pauses and used Mimir governance controls to bring trading, signing, observation and churning into a controlled halt within roughly two hours of the community alert.

That response limited the loss to one vault, but it also forced a broader restart process. THORChain needed to patch the immediate vulnerability, verify active vaults, migrate network state and decide how the $10.7 million deficit would be handled before swaps could safely resume.

The restart lands as cross-chain security remains under pressure across DeFi. THORChain’s own incident followed a wider run of bridge and messaging failures, including Taiko’s chain state verification compromise and a year of bridge-related incidents that pushed tracked cross-chain exploit losses sharply higher.

Protocol-Owned Liquidity Takes The Hit

THORChain’s recovery route avoids a new RUNE mint. The ADR-028 plan uses protocol-owned liquidity to absorb the loss rather than selling or issuing new RUNE, keeping the recapitalization burden inside the protocol’s own balance sheet instead of diluting token holders through emergency supply expansion.

That trade-off protects the RUNE supply narrative, but it still carries an operational cost. Protocol-owned liquidity can support depth, routing efficiency and confidence around large swaps. Using it to cover an exploit loss means the protocol absorbs the hit directly, while the network has to rebuild activity through fees, liquidity return and renewed trust from traders and integrators.

The restart also reopens the roadmap around native privacy-asset support. THORChain said Monero and Zcash support remain part of the next expansion path, alongside dynamic fees and liquidity improvements. Those additions could bring fresh volume if the restarted network stays stable, but they also raise the security bar for vault operations and chain integrations.

THORChain’s latest operational status is now clear: trading, swaps, liquidity-provider actions, signing and churning are back online after the May 15 vault exploit. The $10.7 million loss is being handled through protocol-owned liquidity under the no-new-RUNE recovery path, with the network’s next test now moving from restart coordination to live vault stability, liquidity depth and post-exploit user confidence.

The post THORChain Restarts Trading After $10.7M Vault Exploit Without New RUNE Mint appeared first on Crypto Adventure.