THORChain's breach is a rounding error in 2026's record year for crypto theft- 242

June 28, 2026

THORChain, a decentralized cryptocurrency exchange founded in Switzerland in 2018, lost roughly $10.7 million on a Friday morning in June after one of its six operational vaults was compromised — a loss small enough that the platform's own automated defenses caught it within minutes, yet significant enough to sit as just the latest entry in a year that has already seen crypto platforms lose hundreds of millions of dollars to increasingly capable, and increasingly state-linked, attackers.

The mechanics of the incident reflect a system that worked largely as designed, even as it failed to prevent the theft outright. Blockchain security firm Peckshield and independent investigator Zachary Wolk, known online as ZachXBT, first identified the anomalous activity around 6 a.m. EST, tracking roughly 36 Bitcoin — about $3 million — alongside another $7 million in other cryptocurrencies being siphoned from the platform. THORChain's own network detected the abnormal behavior automatically and halted signing activity before further outbound transactions could occur, limiting what could have been a substantially larger loss. The company was careful to distinguish between the two categories of funds at risk: user deposits remained safe, with only protocol-owned funds — assets THORChain itself holds rather than customer balances — affected by the vault compromise.

The incident carries a specific, uncomfortable history for THORChain. One of the platform's own founders lost $1.2 million in cryptocurrency last year after an alleged North Korean hacker compromised their personal account — meaning this is not the first time state-linked actors have specifically targeted people connected to this exchange. That prior incident sits within a much larger 2026 pattern this publication has tracked developing across the crypto industry: platforms have collectively lost more than $200 million so far this year, including individual thefts of $26 million and $40 million at other exchanges, a $280 million theft from the Drift platform that prompted the U.S. Treasury Department to begin sharing cyber threat intelligence directly with the cryptocurrency industry, and — just days after that Treasury announcement took effect — a separate $290 million theft attributed to alleged North Korean hackers using a notably complex attack chain. Set against 2025's total of more than $2 billion stolen collectively across dozens of platforms, THORChain's $10.7 million loss is almost modest by comparison, but it reinforces the same underlying pattern: state-linked actors, North Korea foremost among them, have identified cryptocurrency infrastructure as a reliable, high-value, and comparatively low-risk revenue source, and neither individual platform defenses nor sector-wide intelligence sharing has yet closed that gap.