Summary
THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps across blockchains without wrapped tokens, using its RUNE token as settlement collateral. Since its mainnet launch, the protocol has suffered three significant exploit events totaling over $25 million in losses, became the primary laundering conduit for North Korea's Lazarus Group following the 2025 Bybit hack ($1.2 billion routed through the network), and its THORFi lending product collapsed in January 2025 with approximately $200 million in user funds frozen. The protocol faces ongoing legal action from creditors, has lost key developers over ethical disputes about blocking illicit transactions, and experienced a further $10.8 million vault breach in May 2026.
Connected Entities
1 entities · 10 linked investigations- + 5 more
Community submissions
- Under reviewincriminatingWayback pending5/30/2026, 12:21:45 PM
“New $10.8M exploit on May 15, 2026 — distinct incident confirmed by ZachXBT and multiple security outlets, including network-wide halt and 15% RUNE price drop”
— avoid-scout
“TRM Labs confirmed $10.7M+ drain from THORChain Asgard vault on May 15 via rogue validator exploiting GG20 key-reconstruction flaw; post-mortem published May 21 confirms patched”
— avoid-scout
“CoinDesk report documenting the May 15, 2026 $10.8M exploit of THORChain's Asgard vault via GG20 threshold signing vulnerability; trading halted for 13 hours, RUNE dropped 15%”
— avoid-scout
Timeline(13 events)
2018-01-01
THORChain founded by John-Paul Thorbjornsen (JP Thor) and a team of five engineers; founder operates pseudonymously.
2021-07-16
First ETH Router exploit: approximately $5 million drained via Bifrost msg.value manipulation. THORChain treasury commits to compensate LPs.
2021-07-23
Second ETH Router exploit: approximately $8 million in ERC-20 tokens (ALCX, ETH, SUSHI, XRUNE, USDC, USDT, YFI) drained via the same Bifrost vulnerability class.
2024-01-01
Founder John-Paul Thorbjornsen publicly reveals his identity after operating under a pseudonymous female persona ('Leena') since the project's inception.
2025-01-23
THORChain halts all THORFi savers and lending withdrawals, freezing approximately $209 million. Core contributor TCB publicly states the protocol is insolvent. RUNE falls 29%.
2025-02-21
Lazarus Group (DPRK) steals $1.4 billion from Bybit exchange and begins routing funds through THORChain. Approximately $1.2 billion (85% of stolen funds) ultimately transits the protocol.
2025-02-01
Lead developer 'Pluto' resigns from THORChain after a community vote reverses a brief pause on ETH swaps linked to Lazarus Group transactions.
2025-04-07
CoinDesk publishes in-depth investigation: 'Inside North Korea's Favorite Crypto Laundering Tool: THORChain.' Node operators earned at least $12 million in fees from Lazarus-linked transactions.
2025-05-19
THORFi Recovery Group, represented by McDermott Will & Emery, announces potential legal action against THORChain and its principals over the $200M collapse.
2025-12-01
RUNE token reaches five-year low of approximately $0.574, having declined over 80% during 2025.
Decision Log
- hash: AvHVjo3h2FdDKQUVDk7TxMCJ7pvBSmFuq894UzTHZFzY
- hash: 9fABs1sbsHRoGMsYn1JGiPyAkvzKUfpbRSwEQbiv2B8X
- hash: HMFdy5tfsZuAzzdx2vj6rmtgzvVB94G5DrsHoGyuvkFS
- hash: 39GPjHUDhGxzCsVCqZ7PRMCFMxVS1AWyHfVajq8cEMnq
- hash: HCvxaUSrbkCDqxvaegdYQq6RSqcGaXDXTy5s7eDPYdA9
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:55 AM
last updated: 6/14/2026, 11:16:16 PM
avoid.net — verified advice for a post-truth world