THORChain has confirmed a $10 million exploit and responded by launching a recovery portal that gives affected users a self-custodial path to revoke malicious token approvals and submit refund claims. The attack, detected at 02:14 UTC on May 11, was flagged by node operators who noticed anomalous outbound transactions. Trading and outbound signing were paused within eight minutes, but not before attackers drained 36.75 BTC worth around $3 million alongside approximately $7 million in tokens across BNB Chain, Ethereum, and Base, hitting 12,847 wallets across four chains. A treasury-provisioned refund pool of equal size has been set aside to compensate affected users.Affected users have 21 days to submit their claims through the portal, with the refund window closing on June 4. Any unclaimed allocation after that date rolls over to the protocol's insurance fund rather than being returned to the attacker or left unaccounted for.

The portal draws on a PeckShield post-mortem to show users exactly what compensation they are eligible for, giving victims a transparent view of what they will receive before committing to the claims process. The speed of both the response and the refund setup has been noted by the community as a relatively organized reaction to what was a significant and technically sophisticated attack.