THORChain got hit for $10M today. JP says it was the TSS, not the Router.

$10M out of THORChain across Bitcoin, Ethereum, BSC, and Base on May 15, 2026. JP's early read points to a GG20 TSS exploit on the Asgard vaults, not the Router contract. Trading is paused via Mimir. This is the cost of building cross-chain rails in the open — and why I still think THORChain is the team to back.

THORChain was exploited today, May 15, 2026, for ~$10M across four chains: Bitcoin, Ethereum, BSC and Base.⁰³ The details are still developing. This piece covers everything that is known so far, the timeline of how it went down, and what the next 72 hours decide.

ZachXBT flagged it first.⁰¹ Cyvers had pinged the initial $7.2M of suspicious activity before that, and KuCoin's flash headline that hour read literally "THORChain Router Suspected of Attack."⁰² THORChain's official X account followed with deliberately careful language:

There are claims of a potential vulnerability with a THORChain dependency that may affect THORChain. Out of an abundance of caution, trading has been paused while an investigation is undertaken.THORChain official statement, May 15, 2026

Trading was subsequently halted at block 26190429,¹⁰ following the decentralized governance protocols in place where nodes and community members can flag suspicious activity on the network. RUNE is down from roughly $0.58 to $0.50 — a ~12% dip.⁰⁴⁰⁶

§ 01 What happened

The protocol shipped v3.18.0 on May 14, the day before. From everything I have read so far, it does not appear that the release is related in any way to today's exploit. v3.18.0 covered Protocol-Owned Liquidity foundations, ADR-026's Dynamic Fee Model, and routine security improvements. The exploit landed on a different surface entirely.

JP, co-founder of THORChain, posted on X that this was likely a GG20 TSS exploit:¹¹

Malicious node churns in, extracts key material from other nodes, compiles a private key and can sweep the vault.JP Thorbjornsen, co-founder of THORChain, May 15, 2026

If JP's read holds, this is a meaningfully different incident from the 2021 ETH Router series.¹³ The 2021 vectors were bugs in the Router contract and the Bifrost observer layer¹² — the surfaces that watch what is coming INTO Asgard. A GG20 TSS exploit targets the threshold-signature scheme that signs what comes OUT of Asgard. Same custody model, different surface. The previous 2021 exploits found bugs in the Router; this appears to be related to vault signing.

KuCoin's flash headline named the Router.⁰² THORChain's own statement used the broader word "dependency."¹⁰ JP's read points to the TSS keygen/resharing path.¹¹ The technical post-mortem will resolve which of those is correct. Until it does, treat the specific vector as live-updating and read the attribution accordingly.

§ 02 But isn't THORChain decentralized?!

The fight over decentralization in the crypto space is a heated one. People love to call each other out for not being decentralized. In THORChain's case, the reason this exploit was possible in the first place is BECAUSE THORChain is so decentralized.

From the current understanding of the hack, the Asgard vault model is what was exploited. THORChain does not run a bridge in the conventional sense. It runs validators that jointly custody real assets on every supported chain, with 2/3 of nodes signing via a threshold-signature scheme¹² — the same TSS layer JP referenced. Asgard vaults are the big pooled vaults. They hold the majority of TVL. On EVM chains a smart contract called the Router sits in front, accepts inbound deposits, sweeps them to Asgard, and processes swaps.

Elegant on paper. In practice it makes Asgard the highest-value continuously-online target in DeFi that is not a centralized exchange. The honeypot is permanently on the table. This is exactly how a decentralized protocol operates and it produces a "for better or worse" dynamic. When you are centralized, you can easily obfuscate attack surfaces. When you are decentralized — as THORChain is — you are putting it all out in the open. Researchers, attackers and node operators can read the same code at the same time, and the same code that lets a friendly engineer find a bug at noon lets a hostile one find it at one.

That openness is a tax. It is not a bug. It is the price you pay for a system whose validator set, source code, vault math, halt mechanics and Mimir governance are all public. The same property that makes today's incident possible is what makes THORChain a credible piece of cross-chain infrastructure in the first place. You cannot have one without the other.

§ 03 What I want to see in the next 72 hours

Two questions matter and nothing else.

First: what was the actual vector? If this is a fresh class of bug — a new TSS edge case, a new dependency, a new chain-client path — it patches and the protocol becomes stronger moving forward. It is an expensive way to QA a system, but when you are building a real decentralized DEX, you get the good and the ugly of being out in the open. The patch cycle the protocol ran after the 2021 series¹⁴¹⁶ produced four years of hardening; the patch cycle that follows this one will produce more.

Second: can the treasury absorb $10M without diluting RUNE holders? The protocol is much further along financially than it was four years ago. The vast majority of liquidity in the network is Protocol-Owned Liquidity — the protocol is largely backstopping itself rather than depending on third-party LP capital sitting in pools. The cross-chain space has also evolved a lot. THORChain has recently shipped Rapid Swaps, which dramatically improve liquidity efficiency, on top of the previously released Streaming Swaps. Together those mean liquidity goes much further per dollar of capital — the protocol can scale and earn on significantly less working capital than it once needed.

Put those together and this hack will likely lead to zero loss of user funds, whether you are measuring user capital in the protocol or RUNE value in your wallet. The treasury absorbs the impact. Hyper-efficient liquidity usage means THORChain recoups the losses quickly once trading resumes and volume flows again. That is the difference between a $10M loss in 2021 and a $10M loss in 2026.¹⁷

§ 04 The discount on RUNE, not the value of the problem

Cross-chain liquidity is the most valuable unsolved problem in DeFi and THORChain is one of the few ecosystems that has solved it at scale and in a way that is decentralized. It is critical infrastructure for the industry, and I want to see it succeed. Bumps like these happen routinely for top protocols — Bitcoin, Ethereum, the rest of the foundational layer. The pattern is the same: take the QA cost as a lesson, harden the code, push forward. THORChain has done that before. I am quite confident it will do it again.

Today does not change the value of the cross-chain liquidity problem. It changes the discount the market puts on RUNE as the asset that backs a leading protocol in that space.

If you want to track the recovery in real time, you can use the Cross-Chain Status tool my team built at status.leodex.io¹⁸ — it tracks every cross-chain protocol we support in real time. As of this writing, both THORChain and Maya Protocol are halted because of this incident. When they come back online, that page will be the first to report it.

If you trade cross-chain, leodex.io¹⁹ is the secure cross-chain swap app my team and I built. Low fees, no account signups, 107+ DEXes aggregated — THORChain among them. When THORChain is paused, the routing engine surfaces every other available venue automatically.

Survive > maximise.