THORChain confirmed a $10 million exploit and deployed a recovery portal to help affected users across four blockchain networks. The portal enables victims to revoke malicious token approvals and claim refunds for stolen funds.

The exploit compromised user accounts through unauthorized token approvals, a common attack vector in cross-chain protocols. Attackers gained the ability to drain tokens from wallets without direct private key compromise. The breach affected users on multiple chains, indicating the attack targeted THORChain's cross-chain liquidity infrastructure.

The recovery portal represents THORChain's immediate response to contain damage. Users can access the tool to revoke approvals that allowed the exploit to function, preventing further drains. The refund mechanism suggests THORChain is compensating losses directly, though specific details on refund percentages or timelines remain unclear from available information.

This incident reflects ongoing security risks in cross-chain bridges and liquidity protocols. THORChain has experienced multiple exploits in recent years, raising questions about the protocol's security architecture. The $10 million loss ranks among mid-sized DeFi hacks but demonstrates that even established protocols remain vulnerable to approval-based attacks.

The portal launch shows THORChain attempting rapid user compensation and damage control. Recovery portals have become standard practice after DeFi exploits, allowing protocols to maintain community trust while addressing technical vulnerabilities.

For affected users, immediate action matters. Revoking approvals stops ongoing token drains, while claiming refunds through the official portal provides compensation. Users should verify the portal's authenticity before interacting to avoid secondary phishing attacks.

THORChain's development team likely faces pressure to conduct a full security audit and implement additional safeguards on token approval mechanisms. The protocol's cross-chain design requires robust approval controls to prevent similar incidents. Community confidence in THORChain depends on transparent disclosure of the attack vector and concrete security improvements rolling out in coming weeks.