THORChain confirms a $10 million exploit on May 11 and launches a self-custodial recovery portal for affected users.