THORChain said one of its Asgard vaults was exploited, with preliminary losses estimated at $10.7 million, and the network has halted trading across the board. The protocol said its automated detection system spotted abnormal activity earlier in the day and stopped signing operations, blocking what could have become additional outbound transactions. Early findings indicate the affected assets were mainly protocol-owned funds, while user funds remain safe and no user swap was impacted.
One of six Asgard vaults appears to have been compromised
According to the project’s incident update, THORChain operates six Asgard vaults across the network, and one of them appears to have been breached. Trading was paused as an immediate containment step. The team said abnormal signatures were detected automatically, which allowed the network to shut down signing activity before losses grew larger.
The initial loss estimate stands at $10.7 million. THORChain said current evidence points to damage limited mainly to protocol-owned assets rather than customer balances. It also stated that no user swap transaction was affected during the incident.
Slashing applied, churn operations put on hold
THORChain said the nodes responsible for the affected vault have been penalized, with their bonded RUNE slashed. The network has also paused churn activity. That means new chain integrations and any operation requiring churn will be delayed until the network is considered stable again.
Contributors are still investigating the root cause and working on a fix. At the same time, THORChain called on node operators to inspect their infrastructure, including server hosts, key management systems, and operational security. Operators tied to the affected vault were asked to securely provide Bifrost logs to the development team for analysis. Any suspicious signs should be reported through the project’s official Discord channel.
RUNE falls below $0.5 after the disclosure
Following news of the exploit, RUNE dropped below $0.5. At the time of the source report, the investigation and remediation process was still underway, and the project had not provided a timetable for resuming normal network trading.