THORChain has temporarily halted trading across its network after detecting abnormal behavior linked to one of its Asgard vaults. According to the protocol’s official announcement, the issue was automatically identified by the network’s security systems, which immediately halted signing activity and prevented additional outbound transactions from taking place.
Initial estimates place the loss at approximately $10.7 million, though early indications suggest that user funds and individual swaps were not directly affected by the incident.
The compromised infrastructure reportedly involved one out of six Asgard vaults used within the THORChain ecosystem. Asgard vaults are critical components of the protocol’s cross-chain liquidity architecture, holding assets that facilitate decentralized swaps between multiple blockchain networks.
Following the detection, the network paused churn activity, a process responsible for rotating validator sets and vault responsibilities, in order to stabilize operations while the investigation continues.
Network Investigation, Validator Impact, and Security Measures
THORChain contributors and developers are actively investigating the root cause of the compromise while coordinating with node operators across the network.
Validators associated with the affected vault were automatically subjected to bonded RUNE slashing as part of the protocol’s built-in security mechanisms, which are designed to penalize nodes connected to unauthorized transactions or operational failures. This mechanism helps align validator incentives with network security while limiting systemic risks during incidents.
In response to the breach, node operators have been instructed to immediately audit their infrastructure, host environments, operational security systems, and key management setups for any signs of compromise. Operators participating in the affected vault were also requested to securely provide Bifrost logs to developers to assist with forensic analysis and remediation efforts.
Related: THORChain (RUNE) Executes Largest Token Burn in Economic Adjustment
Until the situation is fully resolved, onboarding of additional chains and operations dependent on churn activity will remain delayed.
Despite the disruption, the automated halt of signing activity demonstrated THORChain’s ability to detect and contain abnormal behavior before broader damage could occur. The incident also highlights the increasing importance of operational security and infrastructure resilience within decentralized cross-chain protocols as they continue to manage large amounts of liquidity across multiple blockchain ecosystems.
Related: THORChain v3.17.0: This Quiet Upgrade Signals a Maturing DeFi