{"investigation":{"slug":"thorchain-dex","entity_name":"Thorchain DEX","trust_score":28,"severity_base":null,"score_modifier":6,"confidence":0.87,"status":"published","content_type":"investigation","summary":"THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps across blockchains without wrapped tokens, using its RUNE token as settlement collateral. Since its mainnet launch, the protocol has suffered three significant exploit events totaling over $25 million in losses, became the primary laundering conduit for North Korea's Lazarus Group following the 2025 Bybit hack ($1.2 billion routed through the network), and its THORFi lending product collapsed in January 2025 with approximately $200 million in user funds frozen. The protocol faces ongoing legal action from creditors, has lost key developers over ethical disputes about blocking illicit transactions, and experienced a further $10.8 million vault breach in May 2026.","sections":[{"content":"THORChain is a decentralized cross-chain liquidity protocol founded in 2018 by John-Paul Thorbjornsen (publicly known as \"JP Thor\"), who operated pseudonymously under a fabricated female persona called \"Leena\" for approximately six years before revealing his identity in 2024. The protocol enables non-custodial swaps of native Layer 1 assets — including Bitcoin, Ethereum, and others — without requiring wrapped tokens, using its native RUNE token as the settlement and bonding asset. THORChain mainnet went live in June 2022 after approximately four years of development. As of early 2025, the protocol had generated $47 million in lifetime fees and served as a significant DeFi infrastructure layer for cross-chain liquidity.","heading":"Protocol Overview","sources":[{"url":"https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.technologyreview.com/2026/02/18/1132587/jean-paul-thorbjornsen-dark-side-crypto-permissionless-dream/","name":"technologyreview.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In July 2021, THORChain suffered two consecutive exploits of its Ethereum Router component, resulting in combined losses of approximately $13 million. The first exploit occurred on July 16, 2021, draining approximately $5 million in ETH and ERC-20 tokens. The attacker exploited a vulnerability in Bifrost — THORChain's bridge to Ethereum — by wrapping the router with a custom contract and using an override loop function to set a transaction msg.value of 200 while depositing zero actual value. Bifrost read only the reported msg.value, crediting the attacker with tokens that were never deposited. The second exploit, disclosed on July 23, 2021, drained approximately $8 million in mixed ERC-20 tokens including ALCX, ETH, Sushi Token, XRUNE, USDC, USDT, and YFI through a variant of the same Bifrost manipulation. In both cases, the root cause was a Bifrost interface that did not fully account for the range of manipulation possible through smart contract event callbacks. The anonymous hacker behind the second exploit reportedly claimed to be \"teaching a lesson\" and demanded THORChain slow its development. The THORChain treasury committed to compensate all affected liquidity providers. Security firm SlowMist subsequently published a detailed analysis of all three consecutive attacks on the protocol during this period.","heading":"2021 ETH Router Exploits","sources":[{"url":"https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/111660/thorchain-suffers-5-million-exploit-developers-have-put-out-a-fix","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/112308/thorchain-suffers-8-million-loss-by-hacker-wanting-to-teach-lesson","name":"theblock.co","type":"other","credibility":3},{"url":"https://medium.com/thorchain/post-mortem-eth-router-exploits-1-2-and-premature-return-to-trading-incident-2908928c5fb","name":"medium.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-thorchain-hack-july-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-analysis-of-three-consecutive-attacks-on-thorchain-6223f1c691be","name":"slowmist.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Between 2022 and 2024, THORChain expanded beyond its core DEX functionality by launching a suite of savings and lending products under the brand \"THORFi.\" These products attracted significant user deposits, but the protocol's mechanism for meeting lending obligations — minting RUNE tokens and selling them into internal liquidity pools — created a reflexive, unsustainable debt cycle. On January 23, 2025, the network halted all THORFi savers and lending withdrawals, freezing approximately $209 million in user deposits and outstanding borrowings. This included approximately $111 million in borrowed assets and $98 million in savers vaults (approximately $57 million in Bitcoin and $16 million in Ethereum). A core community contributor identified as \"TCB\" disclosed publicly that the protocol was effectively insolvent — unable to meet bitcoin and ether-denominated obligations if large redemptions were attempted simultaneously. RUNE's token price fell approximately 29% following the announcement, reaching $2.08. The network subsequently opened a 90-day recovery window, and the community voted to convert outstanding THORFi debt into a new equity token called \"Thorchain Yield\" (TCY), which grants holders 10% of protocol revenue indefinitely. Critics alleged the product was launched without adequate risk controls, stress testing, or collateralization safeguards.","heading":"THORFi Insolvency and $200M Frozen Funds (2025)","sources":[{"url":"https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on","name":"decrypt.co","type":"other","credibility":3},{"url":"https://crypto.news/thorchain-in-massive-200m-debt-pauses-network-for-restructuring-votes/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/thorchain-bitcoin-ether-insolvency/","name":"ccn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the January 2025 THORFi collapse, a group of affected creditors formed the \"THORFi Recovery Group\" and retained law firm McDermott Will & Emery, assisted by forensic advisory firm J.S. Held. On May 19, 2025, the group publicly announced potential legal proceedings against THORChain and its principals, alleging mismanagement and insolvency. The group established a dedicated site (thorchainlawsuit.com) for affected creditors to register. As of mid-2025, no formal court filings have been publicly confirmed; the action remains at the pre-litigation investigation and creditor-aggregation stage. The total recovery sought is approximately $200 million.","heading":"Legal Action: THORFi Recovery Group","sources":[{"url":"https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","name":"chainwire.org","type":"other","credibility":3},{"url":"https://cryptoslate.com/press-releases/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.thorchainlawsuit.com/","name":"thorchainlawsuit.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the February 21, 2025 hack of Bybit — in which North Korean state-affiliated hacking group Lazarus Group stole approximately $1.4 billion in ETH — THORChain became the primary vehicle for laundering the proceeds. Blockchain analytics firms Chainalysis and Chainalysis-affiliated researchers tracked approximately $1.2 billion, representing roughly 85% of all stolen funds, flowing through the THORChain network as ETH was converted into Bitcoin and other assets. THORChain node operators collectively earned an estimated $12 million in fees from these transactions, according to Chainalysis. Wallet applications built on THORChain, including Asgardex, earned approximately $1 million. When FBI warnings prompted some validators to briefly pause ETH swaps on the network, the move was reversed after approximately 30 minutes following community pushback from participants who opposed what they characterized as censorship of the permissionless protocol. This reversal triggered the resignation of lead developer \"Pluto,\" who stated he would \"no longer be contributing to THORChain.\" Core contributor \"TCB\" warned that facilitating flows from the largest money heist in history would likely become a national security issue. Founder JP Thor (John-Paul Thorbjornsen) maintained that THORChain operates as a decentralized protocol and cannot be held responsible for transaction content. Lazarus Group subsequently used THORChain again in 2026 to launder approximately $292 million from the KelpDAO rsETH exploit.","heading":"North Korea Lazarus Group Laundering (2025)","sources":[{"url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/thorchain-role-in-lazarus-laundering-is-big-defi-problem/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/lazarus-laundering-spree-threatens-chainflip-and-thorchain/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/bybit-hacker-launders-270k-eth-via-thorchain-still-holds-514m/","name":"cryptonews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 15, 2026, THORChain suffered a further exploit in which approximately $10.8 million was drained from a network vault across nine blockchains: Ethereum, Bitcoin, Binance Smart Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP. According to a post-incident report published by THORChain on May 21, 2026, the attacker operated a malicious validator node (identified as thor16ucjv3v695mq283me7esh0wdhajjalengcn84q) that joined the network on May 13. Over two days of routine GG20 Threshold Signature Scheme signing operations, the attacker incrementally reconstructed a vault's private key, then used it to initiate unauthorized outbound transactions bypassing normal approval mechanisms. Chainalysis traced preparatory activity to late April 2026, including funding via Monero privacy bridges, conversion to USDC through Hyperliquid, and ETH bridging to bond the malicious node. THORChain's automated solvency system detected abnormal vault balances after losses exceeded its 1% threshold and halted trading within 52 minutes, freezing the network for approximately 13 hours. TRM Labs confirmed the exploit was traced across chains but had not attributed it to a specific actor as of publication. No user-controlled funds were lost; losses were confined to protocol-owned vault liquidity. ZachXBT flagged the exploit on-chain in real time. THORChain subsequently offered the attacker a bounty for return of funds.","heading":"May 2026 Multi-Chain Vault Exploit ($10.8M)","sources":[{"url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","name":"trmlabs.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/05/17/10-8-million-drained-inside-the-thorchain-exploit-that-froze-cross-chain-defi-for-13-hours/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","name":"coindesk.com","type":"other","credibility":3},{"url":"https://crypto.news/thorchain-offers-hacker-bounty-as-restart-vote-opens/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"In 2025, THORChain co-founder John-Paul Thorbjornsen (JP Thor) reported that his personal wallet was drained of approximately $1.35 million in a social engineering attack attributed to North Korean state-affiliated actors. The attack combined a compromised Telegram account, a deepfake Zoom call, and an alleged zero-day exploit. Blockchain investigator ZachXBT noted the incident, with some commentators describing it as ironic given the protocol's refusal to block North Korean transactions. CryptoNews and other outlets reported the incident was traced to DPRK Telegram-based phishing infrastructure.","heading":"Founder Personal Hack (North Korea, 2025)","sources":[{"url":"https://cryptonews.com/news/thorchain-co-founders-wallet-drained-1-35m-in-dprk-telegram-scam/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://coinnews.com/news/north-korean-hackers-stole-1-3m-from-thorchain-co-founders-wallet-zachxbt-says-its-poetic/","name":"coinnews.com","type":"other","credibility":3},{"url":"https://beincrypto.com/north-korea-hack-thorchain-founder-1-3-million/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"RUNE, THORChain's native token, experienced significant price deterioration from 2024 through 2025. The token fell over 80% in 2025, reaching a five-year low of approximately $0.574 in December 2025, down from a peak of approximately $20 in 2021. The combined effects of the THORFi insolvency announcement, Lazarus Group controversy, and repeated hacks contributed to sustained selling pressure. The token also dropped approximately 10–12% on the day of the May 2026 exploit. RUNE's tokenomics tie its value to protocol health, as it is used as collateral in liquidity pools — meaning protocol-level losses have a direct reflexive effect on the token price.","heading":"RUNE Token Performance and Market Impact","sources":[{"url":"https://www.thecryptoupdates.com/thorchain-faces-insolvency-claims-amid-26-price-drop-a-lesson/","name":"thecryptoupdates.com","type":"other","credibility":3},{"url":"https://www.tronweekly.com/thorchain-hack-drains-10m-as-rune-drops-10/","name":"tronweekly.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"THORChain founded by John-Paul Thorbjornsen (JP Thor) and a team of five engineers; founder operates pseudonymously.","source":"","date_original":"2018-01-01"},{"date":"2021-07-16","event":"First ETH Router exploit: approximately $5 million drained via Bifrost msg.value manipulation. THORChain treasury commits to compensate LPs.","source":"","source_url":"https://www.theblock.co/post/111660/thorchain-suffers-5-million-exploit-developers-have-put-out-a-fix"},{"date":"2021-07-23","event":"Second ETH Router exploit: approximately $8 million in ERC-20 tokens (ALCX, ETH, SUSHI, XRUNE, USDC, USDT, YFI) drained via the same Bifrost vulnerability class.","source":"","source_url":"https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack"},{"date":"2022-06","event":"THORChain mainnet goes live after approximately four years of development.","source":"","source_url":"https://thorchain.org/","date_original":"2022-06-01"},{"date":"2024","event":"Founder John-Paul Thorbjornsen publicly reveals his identity after operating under a pseudonymous female persona ('Leena') since the project's inception.","source":"","source_url":"https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/","date_original":"2024-01-01"},{"date":"2025-01-23","event":"THORChain halts all THORFi savers and lending withdrawals, freezing approximately $209 million. Core contributor TCB publicly states the protocol is insolvent. RUNE falls 29%.","source":"","source_url":"https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on"},{"date":"2025-02-21","event":"Lazarus Group (DPRK) steals $1.4 billion from Bybit exchange and begins routing funds through THORChain. Approximately $1.2 billion (85% of stolen funds) ultimately transits the protocol.","source":"","source_url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation"},{"date":"2025-02","event":"Lead developer 'Pluto' resigns from THORChain after a community vote reverses a brief pause on ETH swaps linked to Lazarus Group transactions.","source":"","source_url":"https://www.ainvest.com/news/thorchain-developer-quits-north-korea-crypto-laundering-row-2502/","date_original":"2025-02-01"},{"date":"2025-04-07","event":"CoinDesk publishes in-depth investigation: 'Inside North Korea's Favorite Crypto Laundering Tool: THORChain.' Node operators earned at least $12 million in fees from Lazarus-linked transactions.","source":"","source_url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation"},{"date":"2025-05-19","event":"THORFi Recovery Group, represented by McDermott Will & Emery, announces potential legal action against THORChain and its principals over the $200M collapse.","source":"","source_url":"https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/"},{"date":"2025-12","event":"RUNE token reaches five-year low of approximately $0.574, having declined over 80% during 2025.","source":"","source_url":"https://www.thecryptoupdates.com/thorchain-faces-insolvency-claims-amid-26-price-drop-a-lesson/","date_original":"2025-12-01"},{"date":"2026-05-15","event":"Multi-chain vault exploit drains $10.8 million across nine blockchains via malicious validator node exploiting GG20 TSS key reconstruction. ZachXBT flags the exploit in real time. Network halted for 13 hours. RUNE drops 10-12%.","source":"","source_url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now"},{"date":"2026-05-21","event":"THORChain publishes post-incident exploit report identifying the malicious validator node address and reconstruction attack method.","source":"","source_url":"https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/"}],"sources_used":[{"url":"https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack","name":"CoinDesk: Blockchain Protocol Thorchain Suffers $8M Hack","type":"news_article","archive_url":"https://web.archive.org/web/20260725040515/https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack","credibility":1,"archive_timestamp":"2026-07-25T04:05:15+00:00"},{"url":"https://www.theblock.co/post/111660/thorchain-suffers-5-million-exploit-developers-have-put-out-a-fix","name":"The Block: Thorchain suffers $5 million exploit","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/112308/thorchain-suffers-8-million-loss-by-hacker-wanting-to-teach-lesson","name":"The Block: Thorchain suffers another $8 million loss","type":"news_article","archive_url":"http://web.archive.org/web/20250801115541/https://www.theblock.co/post/112308/thorchain-suffers-8-million-loss-by-hacker-wanting-to-teach-lesson","credibility":1,"archive_timestamp":"2025-08-01T11:55:41+00:00"},{"url":"https://medium.com/thorchain/post-mortem-eth-router-exploits-1-2-and-premature-return-to-trading-incident-2908928c5fb","name":"THORChain Medium: Post-mortem ETH Router Exploits 1 & 2","type":"official","archive_url":"http://web.archive.org/web/20260508231435/https://medium.com/thorchain/post-mortem-eth-router-exploits-1-2-and-premature-return-to-trading-incident-2908928c5fb","credibility":2,"archive_timestamp":"2026-05-08T23:14:35+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-thorchain-hack-july-2021","name":"Halborn: Explained: The THORChain Hack (July 2021)","type":"research","archive_url":"http://web.archive.org/web/20260515132317/https://www.halborn.com/blog/post/explained-the-thorchain-hack-july-2021","credibility":2,"archive_timestamp":"2026-05-15T13:23:17+00:00"},{"url":"https://slowmist.medium.com/slowmist-analysis-of-three-consecutive-attacks-on-thorchain-6223f1c691be","name":"SlowMist: Analysis of Three Consecutive Attacks on THORChain","type":"research","archive_url":"http://web.archive.org/web/20250913004058/https://slowmist.medium.com/slowmist-analysis-of-three-consecutive-attacks-on-thorchain-6223f1c691be","credibility":2,"archive_timestamp":"2025-09-13T00:40:58+00:00"},{"url":"https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on","name":"Decrypt: DeFi Network Thorchain Faces $200 Million in Toxic Debt","type":"news_article","archive_url":"http://web.archive.org/web/20260421175045/https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on","credibility":2,"archive_timestamp":"2026-04-21T17:50:45+00:00"},{"url":"https://blockworks.co/news/thorchain-halts-withdrawals-insolvency","name":"Blockworks: THORChain halts withdrawals amid $200M insolvency","type":"news_article","archive_url":"http://web.archive.org/web/20251108071127/https://blockworks.co/news/thorchain-halts-withdrawals-insolvency","credibility":1,"archive_timestamp":"2025-11-08T07:11:27+00:00"},{"url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation","name":"CoinDesk: Inside North Korea's Favorite Crypto Laundering Tool: THORChain","type":"news_article","archive_url":"https://web.archive.org/web/20260724184001/https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation","credibility":1,"archive_timestamp":"2026-07-24T18:40:01+00:00"},{"url":"https://www.dlnews.com/articles/defi/thorchain-role-in-lazarus-laundering-is-big-defi-problem/","name":"DL News: Thorchain watched Lazarus launder $900m in stolen crypto","type":"news_article","archive_url":"http://web.archive.org/web/20260624224337/https://www.dlnews.com/articles/defi/thorchain-role-in-lazarus-laundering-is-big-defi-problem/","credibility":2,"archive_timestamp":"2026-06-24T22:43:37+00:00"},{"url":"https://cryptoslate.com/press-releases/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","name":"CryptoSlate: THORChain Faces Legal Action Over $200M Collapse","type":"news_article","archive_url":"http://web.archive.org/web/20260312104405/https://cryptoslate.com/press-releases/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","credibility":2,"archive_timestamp":"2026-03-12T10:44:05+00:00"},{"url":"https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","name":"Chainwire: THORChain Faces Legal Action Over $200M Collapse","type":"news_article","archive_url":"http://web.archive.org/web/20260512085923/https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","credibility":2,"archive_timestamp":"2026-05-12T08:59:23+00:00"},{"url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","name":"TRM Labs: THORChain Exploit Drains USD 11M+ Across at Least Nine Chains","type":"research","archive_url":"http://web.archive.org/web/20260528032535/https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","credibility":1,"archive_timestamp":"2026-05-28T03:25:35+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","name":"CoinDesk: Thorchain halts trading after $10 million cross-chain exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260522045745/https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","credibility":1,"archive_timestamp":"2026-05-22T04:57:45+00:00"},{"url":"https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit","name":"CoinTelegraph: THORChain Halts Trading After ZachXBT Flags $10M Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260623122059/https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit","credibility":1,"archive_timestamp":"2026-06-23T12:20:59+00:00"},{"url":"https://www.cryptotimes.io/2026/05/17/10-8-million-drained-inside-the-thorchain-exploit-that-froze-cross-chain-defi-for-13-hours/","name":"CryptoTimes: $10.8 Million Drained: Inside the THORChain Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260716105218/https://www.cryptotimes.io/2026/05/17/10-8-million-drained-inside-the-thorchain-exploit-that-froze-cross-chain-defi-for-13-hours/","credibility":2,"archive_timestamp":"2026-07-16T10:52:18+00:00"},{"url":"https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/","name":"CryptoTimes: THORChain Shares Exploit Report Revealing $10.7M Vault Breach","type":"news_article","archive_url":"http://web.archive.org/web/20260604010259/https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/","credibility":2,"archive_timestamp":"2026-06-04T01:02:59+00:00"},{"url":"https://cryptonews.com/news/thorchain-co-founders-wallet-drained-1-35m-in-dprk-telegram-scam/","name":"CryptoNews: THORChain Co-Founder's Wallet Drained $1.35M in DPRK Telegram Scam","type":"news_article","archive_url":"http://web.archive.org/web/20260608212919/https://cryptonews.com/news/thorchain-co-founders-wallet-drained-1-35m-in-dprk-telegram-scam/","credibility":2,"archive_timestamp":"2026-06-08T21:29:19+00:00"},{"url":"https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/","name":"CoinTelegraph Magazine: THORChain founder JP Thor vampire attack DeFi","type":"news_article","archive_url":"https://web.archive.org/web/20260724175132/https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/","credibility":1,"archive_timestamp":"2026-07-24T17:51:32+00:00"},{"url":"https://www.technologyreview.com/2026/02/18/1132587/jean-paul-thorbjornsen-dark-side-crypto-permissionless-dream/","name":"MIT Technology Review: Welcome to the dark side of crypto's permissionless dream","type":"news_article","archive_url":"http://web.archive.org/web/20260723174720/https://www.technologyreview.com/2026/02/18/1132587/jean-paul-thorbjornsen-dark-side-crypto-permissionless-dream/","credibility":1,"archive_timestamp":"2026-07-23T17:47:20+00:00"},{"url":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/","name":"CryptoBriefing: Lazarus Group exploits ThorChain for $292M rsETH laundering","type":"news_article","archive_url":"http://web.archive.org/web/20260510202330/https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/","credibility":2,"archive_timestamp":"2026-05-10T20:23:30+00:00"},{"url":"https://www.thorchainlawsuit.com/","name":"THORChain Lawsuit (creditor recovery site)","type":"other","archive_url":"http://web.archive.org/web/20260413080018/https://www.thorchainlawsuit.com/","credibility":3,"archive_timestamp":"2026-04-13T08:00:18+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:55.771331+00:00","updated_at":"2026-08-29T01:34:15.961+00:00"}}