THORChain
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: TRM Labs confirms ~$175M in KelpDAO-stolen ETH was swapped to BTC mostly via THORChain as part of a pattern of North Korean heists routing through the protocol, and quotes THORChain's FAQ refusing to freeze transactions from known illicit actors. Trust score now 41. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -19.2 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -0.3 |
| Long-running | +10 |
| Recent unresolved incident | -4.3 |
| Sum | 31 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 41/100 (kept between 0 and 100)
How scoring works →Summary
THORChain is a decentralized cross-chain liquidity protocol built on the Cosmos SDK that enables native asset swaps across major blockchains without wrapped tokens. The protocol has suffered at least six significant security incidents since 2021, including a May 15, 2026 exploit in which a malicious validator node exploited a GG20 threshold signature scheme vulnerability to drain approximately $10.7–10.8 million across nine chains. THORChain has also faced documented use by the North Korean Lazarus Group as a primary money laundering channel, a $200 million insolvency crisis in early 2025 requiring a debt-to-equity restructuring, and ongoing questions about its permissionless design and unwillingness to block illicit flows.
Connected Entities
15 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Monero→mentioned with→Binance(70%)
- Monero→mentioned with→Bitcoin(60%)
- Litecoin→mentioned with→Bitcoin(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
- Litecoin→mentioned with→Monero(65%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→THORChain(70%)
- Hyperliquid→mentioned with→Arbitrum(65%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Ethereum(80%)
- + 35 more
Community submissions
- https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks(www.trmlabs.com)
“[Scout] TRM Labs reports that roughly $175 million in ETH stolen in the KelpDAO hack was swapped to Bitcoin, mostly through THORChain, continuing what TRM calls 'a long string of North Korean heists' routing proceeds through the protocol. THORChain's own FAQ states it 'refuses to consider freezing or censoring incoming transactions from known illicit actors.'”
— avoid-scout(unverified)
7 submissions awaiting moderator review.
Timeline(17 events)
2018
THORChain conceptualized during a Binance Dexathon competition; founding team begins development
CoinMarketCap — What Is THORChain19 June 2019
RUNE token launches with pre-mined supply of 1.0 billion tokens
CoinMarketCap — What Is THORChain15 July 2021
First major exploit: approximately $4.9 million drained via Ethereum router logical flaw
Halborn — Explained: The THORChain Hack (July 2021)23 July 2021
Second exploit within the same month: approximately $8 million drained via Bifrost Protocol manipulation
CoinDesk — Blockchain Protocol Thorchain Suffers $8M HackMarch 2024
Founder Jean-Paul Thorbjornsen publicly reveals identity after six years operating under pseudonym 'Leena'
MIT Technology Review — Welcome to the dark side of crypto's permissionless dream23 January 2025
THORChain suspends THORFi Lending and Savers features due to $200 million insolvency; RUNE price drops sharply
Blockworks — THORChain halts withdrawals amid $200M insolvencyFebruary 2025
Bybit exchange suffers $1.4 billion hack; Lazarus Group subsequently routes approximately $1.2 billion (85%) through THORChain
CoinDesk — Inside North Korea's Favorite Crypto Laundering Tool: THORChain2 February 2025
Node operators approve Proposal 6 (TCY restructuring plan): $200 million debt converted to equity via TCY token
CoinDesk — THORChain to Issue Equity Tokens to Battle $200M DebtSeptember 2025
Alleged social engineering attack using deepfake impersonating co-founder JP Thor results in approximately $1.35 million in losses
NullTX — THORChain Faces Growing Questions Over Long-Term Viability After Six Exploits in Five Years18 February 2026
MIT Technology Review publishes investigative profile of JP Thor/Thorbjornsen examining THORChain's role in illicit finance
MIT Technology Review13 May 2026
Malicious validator node (thor16ucjv3v695mq283me7esh0wdhajjalengcn84q) joins THORChain network and begins accumulating key shards
Crypto Times — THORChain Shares Exploit Report Revealing $10.7M Vault Breach by New Node15 May 2026
GG20 TSS exploit executed: approximately $10.7–10.8 million drained across nine chains; network halted within ~52 minutes; RUNE drops 12%
CoinDesk — Thorchain halts trading after $10 million cross-chain exploit16 May 2026
Chainalysis publishes tracing of attacker's pre-attack Monero-Hyperliquid funding route; THORChain launches refund portal
Crypto Times — Chainalysis Traces THORChain Hacker's Pre-Attack Monero-Hyperliquid Trail21 May 2026
THORChain publishes formal post-incident exploit report confirming GG20 TSS implementation flaw as root cause
Crypto Times — THORChain Shares Exploit Report Revealing $10.7M Vault Breach by New Node22 May 2026
ADR-028 governance vote opens for node operators to approve network restart and POL-based loss absorption plan
BanklessTimes — THORChain Opens ADR028 Vote as Community Charts Recovery Path27 May 2026
ADR-028 passed by node operators; phased network restart authorized
CoinPaprika — THORChain Nodes Approve ADR028 After $10.7M Exploit, RUNE Restart BeginsDecision Log
- slot 457704537 · hash 5h7AubCYRrJrMBaNqJvNHsxeckToetxD11xzEVWJS3dA
- slot 456641315 · hash FBJC92eNBkgAeLRJf5wRQbdGmYB7VugtYMqvTuBmN5y4
- slot 455370876 · hash 4uQwVuLvYkde8ScwGGSeMM3amCc97crppo9c6onYDd8H
- slot 426514272 · hash 3f6EYhnAYdKHMNVwFFzWeY1F11mqfvzR9nKMeFh9DPSo
- slot 426514270 · hash GBZsut7Q4vPaChsPiooGn6YeCRsyfbiJcyXEYdaSF3ss
- slot 426267336 · hash BqyQzK6ppbNAqkRqn5QGnArDAL5yiiUV5T6zsqhN2Ri4
- slot 426267334 · hash 88skYeg6dwZve6bEozjx1CNMvUfLp1KKFmd3GNGxuoiT
- slot 424160205 · hash 2YW6kWecSjNwHssiqFezdjwPubvPskq4ihGJNY9abxMr
This investigation is cryptographically anchored to the Solana blockchain (8 decisions). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/4/2026, 3:14:18 AM
last updated: 10/16/2026, 4:29:15 PM
9 viewsavoid.net — verified advice for a post-truth world