← Thorchain DEXreviewed 2026-10-16 · 14 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Thorchain DEX against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #1[unverifiable][awaiting moderator]in section: Protocol Overview
“As of early 2025, the protocol had generated $47 million in lifetime fees and served as a significant DeFi infrastructure layer for cross-chain liquidity.”
reviewerTHORChain generated $47 million in lifetime fees as of early 2025Neither of the two sources cited for this section states a lifetime fee figure at all, and independent DefiLlama snapshots give several different (and inconsistent) cumulative totals, none of which is $47 million. The figure may be real but is not supported by the citations given and could not be independently confirmed.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #11[partially supported][awaiting moderator]in section: North Korea Lazarus Group Laundering (2025)
“Lazarus Group subsequently used THORChain again in 2026 to launder approximately $292 million from the KelpDAO rsETH exploit.”
reviewerLazarus Group used THORChain again in 2026 to launder approximately $292 million from the KelpDAO rsETH exploitThe page's cited source does not support treating the full $292 million exploit size as an amount 'laundered' through THORChain; other reporting puts THORChain-specific flows at a small fraction of that total, split among multiple laundering channels. This conflates the exploit's total size with THORChain's actual role. - #13[partially supported][awaiting moderator]in section: RUNE Token Performance and Market Impact
“The token fell over 80% in 2025, reaching a five-year low of approximately $0.574 in December 2025, down from a peak of approximately $20 in 2021.”
reviewerRUNE fell over 80% in 2025, reaching a five-year low of approximately $0.574 in December 2025, down from a peak of approximately $20 in 2021The $20 2021 peak is independently confirmed. However, the specific $0.574/December 2025 five-year-low figure is not supported by its own cited source, which discusses a different (January 2025) price event entirely. Other price trackers found via search show RUNE around $1.44 in September 2025 and give inconsistent all-time-low figures for 2026 (ranging $0.29-$1.30), so the December 2025 figure could not be independently confirmed or denied; the citation itself simply does not back the claim as written.
confirmed
11 claimsThe cited evidence supports the claim as written.
- #2[confirmed][no action needed]in section: Protocol Overview
“THORChain is a decentralized cross-chain liquidity protocol founded in 2018 by John-Paul Thorbjornsen (publicly known as "JP Thor"), who operated pseudonymously under a fabricated female persona called "Leena" for approximately six years before revealing his identity in 2024.”
reviewerTHORChain founder John-Paul Thorbjornsen operated pseudonymously as a fabricated female persona 'Leena' for approximately six years before revealing his identity in 2024Confirmed by both cited sources. MIT Technology Review adds a minor wrinkle (he reportedly handed day-to-day control of the account to others in 2021) that the page does not mention, but this does not contradict the core claim. - #3[confirmed][no action needed]in section: Protocol Overview
“THORChain mainnet went live in June 2022 after approximately four years of development.”
reviewerTHORChain mainnet went live in June 2022 after approximately four years of developmentConsistent with the cited source and with independent coverage of the June 22, 2022 mainnet announcement found via search. - #4[confirmed][no action needed]in section: 2021 ETH Router Exploits
“The attacker exploited a vulnerability in Bifrost — THORChain's bridge to Ethereum — by wrapping the router with a custom contract and using an override loop function to set a transaction msg.value of 200 while depositing zero actual value.”
reviewerFirst ETH Router exploit (July 16, 2021) drained approximately $5 million via a Bifrost msg.value manipulation (override loop setting msg.value to 200 while depositing zero value)Technical mechanism and dollar figure both confirmed by live, fetched sources. - #5[confirmed][no action needed]in section: 2021 ETH Router Exploits
“The second exploit, disclosed on July 23, 2021, drained approximately $8 million in mixed ERC-20 tokens including ALCX, ETH, Sushi Token, XRUNE, USDC, USDT, and YFI through a variant of the same Bifrost manipulation.”
reviewerSecond ETH Router exploit (disclosed July 23, 2021) drained approximately $8 million in ALCX, ETH, Sushi, XRUNE, USDC, USDT, YFI via a Bifrost vulnerability variant; attacker claimed to be 'teaching a lesson'Consistent with independent search confirmation of both the dollar figure and the attacker's stated motive. - #6[confirmed][no action needed]in section: THORFi Insolvency and $200M Frozen Funds (2025)
“On January 23, 2025, the network halted all THORFi savers and lending withdrawals, freezing approximately $209 million in user deposits and outstanding borrowings. This included approximately $111 million in borrowed assets and $98 million in savers vaults (approximately $57 million in Bitcoin and $16 million in Ethereum).”
reviewerOn January 23, 2025, THORChain halted THORFi withdrawals, freezing approximately $209 million ($111M borrowed, $98M in savers vaults — ~$57M BTC, ~$16M ETH); TCB disclosed insolvency; RUNE fell ~29% to $2.08All figures confirmed verbatim against the cited Decrypt article. Note the source's own $57M+$16M sub-breakdown ($73M) does not fully reconcile with its stated $98M savers total; that imprecision originates in the source, not the page, and the page faithfully reproduces it. - #7[confirmed][no action needed]in section: THORFi Insolvency and $200M Frozen Funds (2025)
“The network subsequently opened a 90-day recovery window, and the community voted to convert outstanding THORFi debt into a new equity token called "Thorchain Yield" (TCY), which grants holders 10% of protocol revenue indefinitely.”
reviewerCommunity voted to convert outstanding THORFi debt into a new token 'Thorchain Yield' (TCY), granting holders 10% of protocol revenue indefinitelyConfirmed via independent search of The Block and related coverage. - #8[confirmed][no action needed]in section: Legal Action: THORFi Recovery Group
“On May 19, 2025, the group publicly announced potential legal proceedings against THORChain and its principals, alleging mismanagement and insolvency.”
reviewerTHORFi Recovery Group retained McDermott Will & Emery (with J.S. Held) and announced potential legal action on May 19, 2025; no formal court filings publicly confirmed as of mid-2025The page accurately flags this as a claimant-side press release / pre-litigation stage rather than a confirmed filed lawsuit, which matches what independent search turned up (no court docket found). - #9[confirmed][no action needed]in section: North Korea Lazarus Group Laundering (2025)
“Blockchain analytics firms Chainalysis and Chainalysis-affiliated researchers tracked approximately $1.2 billion, representing roughly 85% of all stolen funds, flowing through the THORChain network as ETH was converted into Bitcoin and other assets. THORChain node operators collectively earned an estimated $12 million in fees from these transactions, according to Chainalysis. Wallet applications built on THORChain, including Asgardex, earned approximately $1 million.”
reviewerFollowing the Bybit hack, Chainalysis tracked ~$1.2 billion (85% of stolen funds) through THORChain; node operators earned ~$12 million in fees; Asgardex earned ~$1 million; ETH swap pause reversed after ~30 minutesAll figures confirmed against the directly-cited CoinDesk article. Note other outlets (The Defiant) give a lower figure of 83%/~$1B, and a fee estimate of ~$5.5M appears elsewhere, so there is some cross-outlet variance, but the page's cited source directly supports what the page states. - #10[confirmed][no action needed]in section: North Korea Lazarus Group Laundering (2025)
“This reversal triggered the resignation of lead developer "Pluto," who stated he would "no longer be contributing to THORChain."”
reviewerLead developer 'Pluto' resigned after the ETH-swap-pause reversal, stating he would no longer contribute to THORChainConfirmed via independent search; exact resignation quote not independently re-verified word-for-word but the event and timing are well corroborated across multiple outlets. - #12[confirmed][no action needed]in section: May 2026 Multi-Chain Vault Exploit ($10.8M)
“On May 15, 2026, THORChain suffered a further exploit in which approximately $10.8 million was drained from a network vault across nine blockchains: Ethereum, Bitcoin, Binance Smart Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP.”
reviewerMay 15, 2026 vault exploit drained ~$10.8M across nine blockchains via a malicious validator (thor16ucjv3v695mq283me7esh0wdhajjalengcn84q) exploiting GG20 TSS over two days; solvency system halted trading within 52 minutes; network frozen ~13 hours; Chainalysis traced prep to late April 2026 (Monero bridge, Hyperliquid, ETH bridging); ZachXBT flagged it in real time; bounty offeredCore technical narrative is well-supported by the TRM Labs and later CryptoTimes post-incident reporting. Minor nuance: the 'bounty offer' was, per the cited crypto.news article, a proposal under vote rather than a confirmed completed action at the time of that report; this is a small overstatement of certainty but not a factual error given the page's own cited source. - #14[confirmed][no action needed]in section: Founder Personal Hack (North Korea, 2025)
“In 2025, THORChain co-founder John-Paul Thorbjornsen (JP Thor) reported that his personal wallet was drained of approximately $1.35 million in a social engineering attack attributed to North Korean state-affiliated actors.”
reviewerIn 2025, THORChain co-founder's personal wallet was drained of approximately $1.35 million via social engineering attributed to North Korean actorsThe incident, mechanism, and amount are confirmed. The North Korea attribution is correctly framed by the page as an attribution rather than a confirmed fact, matching how the source itself frames it.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.