THORChain Hack
What happened
On May 15, 2026, an attacker drained about $10.7 million from one of THORChain's Asgard vaults. THORChain first estimated the loss at $7.4 million and revised it the same day. The attacker had joined as a validator two days earlier with about 635,000 RUNE bonded.
They exploited weaknesses in THORChain's GG20 threshold-signature library, a fork of Binance's tss-lib that was years behind upstream security fixes, to rebuild the vault's full private key and sign withdrawals alone. THORChain's solvency checks spotted the outflows within minutes and automatic trading and signing halts followed. The operators of the compromised vault had their bonds slashed.
THORChain shipped patches, checked every vault before resuming normal operations, and left the question of who absorbs the loss to a governance process (ADR-028). It also announced a move away from GG20.
How it happened
- The attacker funded operations through Monero and, on May 13, 2026, churned a node (
thor16ucjv3v695mq283me7esh0wdhajjalengcn84q, about 635,000 RUNE bonded) into THORChain's active validator set. - During key generation the node registered a deliberately malformed Paillier key. The GG20 library did not properly validate Paillier moduli, so it accepted a multi-prime key.
- Over about 2.5 days the node triggered 864 signing failures. Flawed range proofs and weak blinding values leaked a piece of the vault's secret key each time.
- With enough leaked material the attacker reconstructed the vault's full private key and signed outbound transactions without the other signers.
- They drained about $10.7 million from that one vault across several chains before THORChain's automatic halts stopped signing.
Protocol details
Security review history
- CertiK View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
