Incident Overview
On May 15, 2026, the cross-chain liquidity protocol THORChain suffered an exploit draining approximately $10.7M from one of its six Asgard vaults. The attack targeted a cryptographic vulnerability in the network's node-signing infrastructure rather than user smart contracts. The protocol’s automated security systems quickly detected the abnormal outbound activity and executed a global emergency halt, safeguarding individual user swaps and limiting further losses to protocol-owned funds.
The exploit was rooted in a structural vulnerability within THORChain's GG20 Threshold Signature Scheme (TSS) implementation. This flaw allowed sensitive cryptographic key material from vault participants to leak incrementally over time. To exploit this, a single malicious actor spinning up a validator node successfully passed the network's churn process and integrated into the active validator set under the address thor16ucjv3v695mq283me7esh0wdhajjalengcn84q.
By controlling an active node and harvesting the leaked TSS material from vault sessions, the attacker reconstructed the complete private key for the targeted Asgard vault. With full private key control, the attacker executed a sequence of unauthorized outbound transactions, shifting assets across Bitcoin, Ethereum, BNB Chain, and Base simultaneously. While the network automated an immediate pause and slashed the attacker's bonded RUNE to penalize the node, the malicious operator managed to route the stolen capital to clean external addresses before the global freeze finalized.
Malicious Node Address: thor16ucjv3v695mq283me7esh0wdhajjalengcn84q
Primary Attacker Wallets:
Bitcoin: bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f37
Ethereum: 0x82fc0d51…3154eb
EVM Secondary: 0xd477b695…8890Bd
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to THORChain, these are the critical security checks that could have prevented this incident (May 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
- 01
- 02
- 03
Learn to Prevent the Next THORChain
The THORChain hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.