THORChain: The $10.7M Key Leak That Broke the Vault

On 1 May 2026 a new account called "Dinosauruss" joined THORChain's developer chat on Discord and asked how to get a node into the network. Two weeks later, on 13 May, a node put up about 635,000 RUNE as a deposit and was admitted as one of the validators that jointly guard THORChain's money. On 15 May it emptied one of the vaults it had been trusted to help protect.

The loss was about $10.7 million, taken from one of THORChain's five vaults in assets on Ethereum, BNB Chain, Base and several other networks. The first official estimate, at 11:01 UTC, was $7.4 million; by evening it had been revised up. The investigator ZachXBT was among the first to flag the outflows publicly. THORChain's own token, RUNE, fell about 15% over the following week. Trading did not fully restart until 23 June, 39 days later.

A swap shop with no owner

THORChain is a crypto exchange with no company holding the money. It lets people swap real Bitcoin for real Ether, or Dogecoin for BNB, without a broker in the middle and without the wrapped IOU tokens that most bridges use. To do that it keeps actual coins on each blockchain in shared vaults, which it calls Asgard vaults. Every vault is controlled by a rotating group of validators: independent node operators who each post a large deposit of RUNE as a bond, the way a security firm might post a bond before being given the keys to a bank's vault. Misbehave and the bond can be taken away, which is called slashing. Every few days the group is reshuffled, a process THORChain calls churning.

The vaults' keys are split. Under a cryptographic scheme called GG20, no single validator ever holds the whole private key, the secret that authorises spending. Instead each holds a share, and a payment goes out only when enough of them run a joint calculation, a signing ceremony, that produces a valid signature without ever assembling the key in one place. It is like a safe that opens only when a majority of directors each turn their own dial at the same moment, without any of them learning the others' combinations.

864 broken ceremonies

THORChain's second exploit report, published on 3 July, explained how the new validator did it. During key setup it planted a deliberately malformed piece of encryption: a number that should have been built from two very large primes was built from several small ones. The signing software, a version of the open-source tss-lib library originally written by Binance, checked only for obviously small factors and accepted it.

Then the validator started failing signing ceremonies on purpose. It broke them 864 times over about two and a half days. Failed ceremonies are common, as nodes crash or lag, so nobody was alarmed, and the attacker simply absorbed the small slashes each failure brought. But every failure leaked a tiny fragment of the other validators' secret shares. Two further flaws, one in how the software checked a mathematical proof and one in how it masked a random number, turned what would have been an occasional, one-in-131,000 leak into a reliable one. THORChain said the first weakness resembled the BitForge and TSSHOCK flaws made public in 2023; the other two were not in published research.

Once enough fragments were collected, the attacker rebuilt the vault's full private key and signed away its contents. Because the transactions carried a perfectly valid signature, THORChain's automatic defences could not block them in advance. Its solvency checker, which compares what the vaults hold with what the books say, spotted the gap and halted signing and trading on Ethereum, Avalanche, BNB Chain, Base, Dogecoin and the Cosmos Hub within about an hour. Solana and other chains that use a different signature system were never exposed.

Why only one vault? THORChain's working theory is money. Attacking a second vault would have required another bonded node worth hundreds of thousands of dollars, and the attacker apparently did not have it.

Who paid, and what changed

Nobody's personal deposits were taken. The stolen money belonged to the pool THORChain owns itself, called protocol-owned liquidity. On 27 May node operators approved a recovery plan, ADR-028, under which that pool absorbed the loss first, with any remainder to be spread across holders of THORChain's synthetic tokens. No new RUNE was printed or sold to cover it. The attacker's node faced full slashing, while honest validators who had shared the vault were protected. A window was opened for the attacker to return funds for a reward. Nothing has come back, and no one has been identified.

THORChain released a patched version, v3.19.1, and before signing resumed every validator had to prove its key share was intact through a temporary check called keyverify. Old vaults were retired. "Every vault verified, every keyshare checked," THORChain posted when trading came back on 23 June. At the restart the protocol held about $27.9 million in total, a fraction of its size in earlier years.

The bigger argument was about GG20 itself. THORChain had hired Silence Laboratories in November 2025 to build a replacement using a newer scheme, DKLS, but the work had been pushed back. Co-founder Chad Barraford defended keeping a patched GG20 for now, telling Cointelegraph that any new standard "could have vulnerabilities too". Critics called the old library a black box that would keep needing patches. The exploit report says the medium-term plan is still to move away from GG20, and suggests new validators may face a minimum wallet age and smaller vaults at first.

Not the first time

THORChain lost about $5 million and about $8 million in two separate exploits of its Bifrost software in the summer of 2021, and halted and reimbursed both times. In 2025 it was the main route North Korea's Lazarus Group used to turn stolen Ether from the $1.5 billion Bybit theft into Bitcoin, which brought it scrutiny of a different kind. This time the hole came from inside the guard rotation itself: one validator, admitted in good standing, that spent two days breaking things until the safe opened. THORChain's own bug bounty, its reward scheme for researchers who report flaws, had been suspended on 31 March for a year because of a flood of low-quality AI-written reports.