THORChain Trading Resumed After $10.7M Vault Exploit

THORChain was reported to have resumed trading on 2026-06-23 after a five-week halt that followed a $10.7 million multichain exploit in May 2026 affecting an Asgard vault.^{[1][2][3][4][5]} Within the present dossier, those points form the core established record: a protocol-level incident occurred in May, the loss was reported at $10.7 million, an Asgard vault was identified as the affected component, trading was halted, and trading later resumed.^[2][3][5][1]

The earliest pivotal moment recorded in the archive metadata was 2026-05-19, which the dossier lists as the primary date for the event.^[4] The source summary described the incident as a multichain exploit in May and stated that it affected an Asgard vault.^[2][3] The available material did not specify whether the exploit originated from a smart-contract flaw, key compromise, logic error, cross-chain message issue, or another failure mode. As of the present record, only the existence of the exploit, its reported scale, and the affected vault designation have been established.^[2][3][5]

Following the exploit, THORChain entered a trading halt that lasted five weeks.^[1] The dossier did not provide a formal incident-response chronology beyond that interruption, and it did not indicate whether the halt applied to all trading functions or only to specific markets or routing paths. It nevertheless established that the exploit had operational consequences substantial enough to be followed by a multiweek suspension and that the suspension was later lifted.^[1][2] In practical terms, the halt functioned as the clearest documented containment measure in the present record, even though the underlying rationale, governance process, and technical remediation steps were not described in the source material.^[1]

The next pivotal point in the documented sequence occurred on 2026-06-23, when The Block reported that THORChain had resumed trading after the halt.^[1] That resumption established a return to operation, but it did not by itself resolve the unanswered forensic questions surrounding the exploit. The dossier did not state whether the protocol had published a root-cause analysis, whether the affected Asgard vault had been recapitalised, or whether any compensatory or recovery process had been completed. The record therefore supports a narrow conclusion: operations resumed after five weeks, but the mechanism of loss and the disposition of funds remain undescribed in the available materials.^[1][3][5]

The loss amount was reported as $10.7 million, and the incident was characterised as multichain rather than confined to a single network.^[2][5] That description is material because THORChain operates across chains, and the mention of an Asgard vault indicates that the affected component was not described merely as a peripheral interface or external integrator in the source summary.^[3] Even so, the dossier did not provide transaction hashes, chain-by-chain loss attribution, or any statement on whether the full reported amount left protocol control in a single sequence or across multiple transfers. The absence of those details prevents reconstruction of the exploit path from the present record alone.

The documented consequences were therefore limited but concrete. THORChain sustained a reported $10.7 million loss, an Asgard vault was identified as affected, and trading was halted for five weeks before resuming.^[5][3][1] The dossier did not include user counts, legal proceedings, regulatory actions, recovery figures, or a formal protocol post-incident report. On the current evidence, the event is established as a completed exploit with material operational disruption and a later return to trading, while the technical and legal record remains incomplete.^[1][2][3][5]