Is THORChain Safe?
Risk Grade: D (67/100)
THORChain is rated as high risk — extreme novelty, critical interactions, unproven at scale.
High risk — repeated hacks, a $200M debt crisis, and money laundering exposure create existential regulatory and security threats
A cross-chain exchange that lets you swap native Bitcoin, Ethereum, and other assets without wrapping or bridging tokens. It handles $180M in deposits across multiple blockchains. Its D+ grade reflects three separate hacks in 2021 ($16M lost), $200M in frozen lending liabilities, and the fact that it processed $1.4B in stolen funds from the Bybit hack.
TVL
$75M
Mechanisms
8
Interactions
7
Value Grade
B-
Key Risks for THORChain Users
The protocol was hacked three times in two months in 2021 for $16M, and its bridge code remains the biggest target for attackers
A lending program accumulated $200M in debt before being shut down -- the RUNE token dropped 74.5% in one quarter during the unwind
It processed $1.4B in stolen funds from the Bybit/North Korea hack, putting it in the same regulatory crosshairs as Tornado Cash
Top Risk Factors
- •Three consecutive exploits in 2021 (~$16M lost) and facilitation of $1.4B in Lazarus Group stolen funds from Bybit hack in 2025 create severe regulatory and security risk
- •THORFi lending/savers programs paused with ~$200M in protocol liabilities; RUNE price fell 74.5% QoQ in Q1 2025 during unwinding
- •Cross-chain Bifrost bridge architecture is inherently high-risk with a proven history of vulnerabilities across multiple attack vectors
How THORChain Compares to Peers
THORChain ranks #111 of 111 DEX protocols (bottom quartile — among the riskiest). At a risk score of 67/100, it's 33 points riskier than the sector average of 34/100.
See the full DEX sector leaderboard or the THORChain vs Cetus Protocol comparison.
Common Questions about THORChain
Plain-English answers based on THORChain's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Track Record (15/15).
Has THORChain ever been hacked or exploited?
THORChain has a documented incident history that materially raised its risk grade — the track record dimension scored 15/15, near the high end of the scale. Past exploits, governance failures, or contract issues are baked into this rating. Anyone considering deposits should review the incident details before allocating capital.
How much money is at stake in THORChain?
THORChain currently holds roughly $75M in user deposits. Smaller TVL means individual depositors carry a larger share of any loss event, and it can be harder to exit a position quickly during stress.
What's the worst-case scenario for THORChain?
Hindenrank has identified specific collapse scenarios for THORChain. The most prominent: "Regulatory Shutdown via Illicit Fund Facilitation". The trigger condition is Regulators designate THORChain as a money laundering facilitator following the Bybit/Lazarus incident, compelling exchanges to delist RUNE and node operators to exit. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is THORChain regulated or insured?
THORChain has some regulatory exposure (6/10), typical of mid-sized DeFi protocols. There is no specific enforcement action on record, but the structure includes elements that regulators have flagged in similar protocols. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for THORChain?
Hindenrank's retail-focused risk audit flagged: The protocol was hacked three times in two months in 2021 for $16M, and its bridge code remains the biggest target for attackers A lending program accumulated $200M in debt before being shut down -- the RUNE token dropped 74.5% in one quarter during the unwind It processed $1.4B in stolen funds from the Bybit/North Korea hack, putting it in the same regulatory crosshairs as Tornado Cash On the technical side, 2 critical-severity interaction risks have been identified.
Should beginners deposit into THORChain?
THORChain carries a D grade — among the riskiest protocols in Hindenrank's coverage. Beginners should not deposit here. Anyone considering a position should understand they may lose everything they put in, and should size accordingly.
How does THORChain compare to safer DEX alternatives?
THORChain is one protocol in Hindenrank's DEX coverage. The safest DEX protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare THORChain against the full DEX ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the THORChain risk report.
Read the Full THORChain Risk Report
This protocol has 3 collapse scenarios. 2 critical and 3 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.