THORChain (RUNE) halted trading and signing on Friday after attackers drained roughly $10.8 million from one of its Asgard vaults, with Ledger's CTO flagging possible MPC weaknesses.
Asgard Vault Drained Across Four Chains
The cross-chain liquidity protocol paused trading and signing operations after on-chain investigator ZachXBT flagged suspicious outflows targeting vaults on Bitcoin (BTC), Ethereum (ETH), BNB Chain, and Base.
In a statement, THORChain said the network automatically detected abnormal activity and suspended signing to block further outbound transfers.
One of six Asgard vaults appeared compromised, churn was paused, and node operators were asked to review key management and operational security.
The protocol's Mimir governance module flipped trading and signing halts to active, with the pause running for roughly 12 hours from block 26190429.
Wallets tied to the attacker hold about 3,443 ETH, 36.85 BTC, and 96.6 BNB, alongside USDT, USDC, WBTC, AAVE, and LINK. RUNE fell about 12% on the news, dropping toward $0.50. THORChain said initial indications suggest user funds were not directly affected.
Also Read: Gemini Space Station Hit By Multiple Securities Fraud Claims After IPO
Ledger CTO Flags MPC Risk
Charles Guillemet, chief technology officer at hardware wallet maker Ledger, suggested the incident could involve weaknesses in threshold signature scheme infrastructure.
Citing remarks from THORChain contributor JP Thor, Guillemet said the breach could be an MPC exploit involving GG20, a threshold signature protocol used in some multi-party computation wallet systems.
He noted that earlier GG18 and GG20 protocols have faced critical vulnerabilities, including CVE-2023-33241 and TSSHOCK.
Guillemet warned that advances in AI-assisted vulnerability discovery may be lowering the bar for compromising validator infrastructure once thought hard to attack.
A theoretical attack path, he said, could involve compromising a validator, waiting for it to join an active vault, exploiting malformed proofs during signing, and reconstructing vault keys offline. He cautioned that the root cause remains unclear, and investigators have not confirmed whether a known GG20 flaw or a new weakness was involved.
THORChain's Recent Security Record
THORChain's vaults rely on TSS, a cryptographic system that lets multiple nodes jointly produce signatures without rebuilding the full private key in one place. The architecture has long been viewed as a strength of cross-chain DeFi, yet it has now drawn fresh scrutiny.
The protocol has weathered several high-profile incidents over the past year. In Feb. 2025, attackers behind the $1.4 billion Bybit hack routed close to $1.2 billion through THORChain to convert assets into Bitcoin.
The KelpDAO exploiter also used the THORChain protocol to move about $80 million in Ether, while THORChain co-founder JP Thorbjornsen lost $1.35 million in a deepfake Zoom scam in Sept. 2025.
Read Next: Southeast Asia Blockchain Week Brings Ripple, Avalanche, Solana Foundation, And K-Pop To Bangkok