THORChain Hack

On May 15, 2026, the cross-chain liquidity protocol THORChain suffered an exploit draining approximately $10.7M from one of its six Asgard vaults. The attack targeted a cryptographic vulnerability in the network's node-signing infrastructure rather than user smart contracts. The protocol’s automated security systems quickly detected the abnormal outbound activity and executed a global emergency halt, safeguarding individual user swaps and limiting further losses to protocol-owned funds.

The exploit was rooted in a structural vulnerability within THORChain's GG20 Threshold Signature Scheme (TSS) implementation. This flaw allowed sensitive cryptographic key material from vault participants to leak incrementally over time. To exploit this, a single malicious actor spinning up a validator node successfully passed the network's churn process and integrated into the active validator set under the address thor16ucjv3v695mq283me7esh0wdhajjalengcn84q.

By controlling an active node and harvesting the leaked TSS material from vault sessions, the attacker reconstructed the complete private key for the targeted Asgard vault. With full private key control, the attacker executed a sequence of unauthorized outbound transactions, shifting assets across Bitcoin, Ethereum, BNB Chain, and Base simultaneously. While the network automated an immediate pause and slashed the attacker's bonded RUNE to penalize the node, the malicious operator managed to route the stolen capital to clean external addresses before the global freeze finalized.

Malicious Node Address: thor16ucjv3v695mq283me7esh0wdhajjalengcn84q

Primary Attacker Wallets:

Bitcoin: bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37

Ethereum: 0x82fc0d51…3154eb

EVM Secondary: 0xd477b695…8890Bd