THORChain DEX Hack:$10.7M Stolen
May 15, 2026 · Bitcoin
Reported by DeFiLlama
As of 2026-10-11 14:31 UTC. These are the feed's figures, not ChainHint's. A freshly reported incident is an unverified third-party claim and the numbers move.
Attacker address
bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37
On-chain check: mempool.space: 2026-05-15 07:31 UTC, 36.8535 BTC into bc1ql4u9…6f37 from bc1qt8f4…zhyv (359 txs, 5,911 BTC received — a THORChain vault) in tx 3f21c687…5804; forwarded 09:43. A second 3.874 BTC from the same vault at 21:00.
Exploit transaction: 3f21c68764…604a5804
Sources: trmlabs.com · blog.thorchain.org
TRM Labs lists it as the initial attacker address receiving the stolen BTC (GG20 TSS exploit by a newly churned node). EVM legs 0x82fc…54eb / 0xd477…90bd not recorded here.
Traced by ChainHint
Not established
The attacker address is verified and queued for ChainHint's nightly trace, which runs the largest losses first. The figures appear here once it has run.
Absence of data is not a clean verdict.
In ChainHint's incident archive
No earlier incident at THORChain DEX is recorded in our archive.
Bridge exploit — 8 incidents of this kind in the 90 days before this page was built, $345M in total, among the incidents ChainHint lists.
THORChain DEX hack: the facts
- How much was stolen in the THORChain DEX hack?
- DeFiLlama reports $10.7M stolen from THORChain DEX on bitcoin.
- Who was hit in the THORChain DEX hack?
- THORChain DEX, on bitcoin, on May 15, 2026. Attack type: bridge exploit.
- Where did the THORChain DEX funds go?
- Not established. The attacker address is verified and queued for ChainHint's nightly trace, which runs the largest losses first. The figures appear here once it has run.
Related hacks
All hacks →
Investigate your own incident
Trace the path of funds across 12 chains on public blockchain data.