Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3FYpHr…WeU4Summary
THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps across blockchains without wrapped tokens, using its RUNE token as settlement collateral. Since its mainnet launch, the protocol has suffered three significant exploit events totaling over $25 million in losses, became the primary laundering conduit for North Korea's Lazarus Group following the 2025 Bybit hack ($1.2 billion routed through the network), and its THORFi lending product collapsed in January 2025 with approximately $200 million in user funds frozen. The protocol faces ongoing legal action from creditors, has lost key developers over ethical disputes about blocking illicit transactions, and experienced a further $10.8 million vault breach in May 2026.
Connected Entities
1 entities- + 5 more
Community submissions
- Under reviewincriminatingWayback pending6/28/2026, 11:08:33 AM
“THORChain restarted June 23, 2026 after 39-day outage from $10.7M May exploit — confirms severity of disruption; Monero swap re-enablement signals ongoing partial recovery”
— avoid-scout
- Under reviewincriminatingWayback pending5/30/2026, 12:21:45 PM
“New $10.8M exploit on May 15, 2026 — distinct incident confirmed by ZachXBT and multiple security outlets, including network-wide halt and 15% RUNE price drop”
— avoid-scout
“TRM Labs confirmed $10.7M+ drain from THORChain Asgard vault on May 15 via rogue validator exploiting GG20 key-reconstruction flaw; post-mortem published May 21 confirms patched”
— avoid-scout
“CoinDesk report documenting the May 15, 2026 $10.8M exploit of THORChain's Asgard vault via GG20 threshold signing vulnerability; trading halted for 13 hours, RUNE dropped 15%”
— avoid-scout
Timeline(13 events)
2018
THORChain founded by John-Paul Thorbjornsen (JP Thor) and a team of five engineers; founder operates pseudonymously.
16 July 2021
First ETH Router exploit: approximately $5 million drained via Bifrost msg.value manipulation. THORChain treasury commits to compensate LPs.
23 July 2021
Second ETH Router exploit: approximately $8 million in ERC-20 tokens (ALCX, ETH, SUSHI, XRUNE, USDC, USDT, YFI) drained via the same Bifrost vulnerability class.
2024
Founder John-Paul Thorbjornsen publicly reveals his identity after operating under a pseudonymous female persona ('Leena') since the project's inception.
23 January 2025
THORChain halts all THORFi savers and lending withdrawals, freezing approximately $209 million. Core contributor TCB publicly states the protocol is insolvent. RUNE falls 29%.
21 February 2025
Lazarus Group (DPRK) steals $1.4 billion from Bybit exchange and begins routing funds through THORChain. Approximately $1.2 billion (85% of stolen funds) ultimately transits the protocol.
February 2025
Lead developer 'Pluto' resigns from THORChain after a community vote reverses a brief pause on ETH swaps linked to Lazarus Group transactions.
7 April 2025
CoinDesk publishes in-depth investigation: 'Inside North Korea's Favorite Crypto Laundering Tool: THORChain.' Node operators earned at least $12 million in fees from Lazarus-linked transactions.
19 May 2025
THORFi Recovery Group, represented by McDermott Will & Emery, announces potential legal action against THORChain and its principals over the $200M collapse.
December 2025
RUNE token reaches five-year low of approximately $0.574, having declined over 80% during 2025.
Decision Log
- hash: AvHVjo3h2FdDKQUVDk7TxMCJ7pvBSmFuq894UzTHZFzY
- hash: 9fABs1sbsHRoGMsYn1JGiPyAkvzKUfpbRSwEQbiv2B8X
- hash: HMFdy5tfsZuAzzdx2vj6rmtgzvVB94G5DrsHoGyuvkFS
- hash: 39GPjHUDhGxzCsVCqZ7PRMCFMxVS1AWyHfVajq8cEMnq
- hash: HCvxaUSrbkCDqxvaegdYQq6RSqcGaXDXTy5s7eDPYdA9
This investigation is cryptographically anchored to the Solana blockchain (5 events). 21 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:55 AM
last updated: 8/29/2026, 1:34:15 AM
avoid.net — verified advice for a post-truth world