Thorchain DEX
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: CryptoTimes confirms a ~$10.8M exploit drained from a THORChain Asgard vault starting around May 15, 2026, with trading/swaps/signing paused, RUNE falling 12-15%, and ZachXBT, Arkham Intelligence and PeckShield involved in flagging/tracing it, matching the submission. Trust score now 19. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3FYpHr…WeU4Summary
THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps across blockchains without wrapped tokens, using its RUNE token as settlement collateral. Since its mainnet launch, the protocol has suffered three significant exploit events totaling over $25 million in losses, became the primary laundering conduit for North Korea's Lazarus Group following the 2025 Bybit hack ($1.2 billion routed through the network), and its THORFi lending product collapsed in January 2025 with approximately $200 million in user funds frozen. The protocol faces ongoing legal action from creditors, has lost key developers over ethical disputes about blocking illicit transactions, and experienced a further $10.8 million vault breach in May 2026.
Connected Entities
15 entities · 60 linked investigations- Thorchain DEX→mentioned with→Bybit(70%)
- Thorchain DEX→mentioned with→THORChain(80%)
- Thorchain DEX→mentioned with→Ethereum(70%)
- Thorchain DEX→mentioned with→Bitcoin(70%)
- Thorchain DEX→mentioned with→ZachXBT(70%)
- Thorchain DEX→mentioned with→Hyperliquid(60%)
- Thorchain DEX→mentioned with→Dogecoin(60%)
- Thorchain DEX→mentioned with→Litecoin(60%)
- Thorchain DEX→mentioned with→Binance(60%)
- Thorchain DEX→mentioned with→Monero(60%)
- + 45 more
Community submissions
- https://www.cryptotimes.io/2026/05/17/10-8-million-drained-inside-the-thorchain-exploit-that-froze-cross-chain-defi-for-13-hours/(www.cryptotimes.io)
“[Scout] A new exploit drained roughly $10.8 million from one of THORChain's six Asgard vaults starting around 09:45 UTC on 15 May 2026, prompting the network to pause trading, swaps, liquidity actions and signing; RUNE fell 12-15% in the following 24 hours. ZachXBT first flagged the unusual outflows, and firms including Arkham Intelligence and PeckShield traced the stolen funds.”
— avoid-scout(unverified)
- https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now(www.trmlabs.com)
“TRM Labs confirmed $10.7M+ drain from THORChain Asgard vault on May 15 via rogue validator exploiting GG20 key-reconstruction flaw; post-mortem published May 21 confirms patched”
— avoid-scout(unverified)
- https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12(www.coindesk.com)
“CoinDesk report documenting the May 15, 2026 $10.8M exploit of THORChain's Asgard vault via GG20 threshold signing vulnerability; trading halted for 13 hours, RUNE dropped 15%”
— avoid-scout(unverified)
2 submissions awaiting moderator review.
Timeline(13 events)
2018
THORChain founded by John-Paul Thorbjornsen (JP Thor) and a team of five engineers; founder operates pseudonymously.
16 July 2021
First ETH Router exploit: approximately $5 million drained via Bifrost msg.value manipulation. THORChain treasury commits to compensate LPs.
23 July 2021
Second ETH Router exploit: approximately $8 million in ERC-20 tokens (ALCX, ETH, SUSHI, XRUNE, USDC, USDT, YFI) drained via the same Bifrost vulnerability class.
2024
Founder John-Paul Thorbjornsen publicly reveals his identity after operating under a pseudonymous female persona ('Leena') since the project's inception.
23 January 2025
THORChain halts all THORFi savers and lending withdrawals, freezing approximately $209 million. Core contributor TCB publicly states the protocol is insolvent. RUNE falls 29%.
21 February 2025
Lazarus Group (DPRK) steals $1.4 billion from Bybit exchange and begins routing funds through THORChain. Approximately $1.2 billion (85% of stolen funds) ultimately transits the protocol.
February 2025
Lead developer 'Pluto' resigns from THORChain after a community vote reverses a brief pause on ETH swaps linked to Lazarus Group transactions.
7 April 2025
CoinDesk publishes in-depth investigation: 'Inside North Korea's Favorite Crypto Laundering Tool: THORChain.' Node operators earned at least $12 million in fees from Lazarus-linked transactions.
19 May 2025
THORFi Recovery Group, represented by McDermott Will & Emery, announces potential legal action against THORChain and its principals over the $200M collapse.
December 2025
RUNE token reaches five-year low of approximately $0.574, having declined over 80% during 2025.
Decision Log
- slot 457821539 · hash 7nx5GoeFGRexzkFfTUEb6LcGyV1EBHvP8Exa3j15Crbq
- slot 457470707 · hash HYLKGL8p6j1RZNWvWRfyD9RKK3nBB895kobi5NqA3EZK
- slot 426514840 · hash AvHVjo3h2FdDKQUVDk7TxMCJ7pvBSmFuq894UzTHZFzY
- slot 426514837 · hash 9fABs1sbsHRoGMsYn1JGiPyAkvzKUfpbRSwEQbiv2B8X
- slot 422972032 · hash HMFdy5tfsZuAzzdx2vj6rmtgzvVB94G5DrsHoGyuvkFS
- slot 422972029 · hash 39GPjHUDhGxzCsVCqZ7PRMCFMxVS1AWyHfVajq8cEMnq
- slot 422769737 · hash HCvxaUSrbkCDqxvaegdYQq6RSqcGaXDXTy5s7eDPYdA9
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 21 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:55 AM
last updated: 10/16/2026, 2:28:39 AM
5 viewsavoid.net — verified advice for a post-truth world