Skip to main content
AVOID.NET
Sign in

THORChain GG20 MPC Vault Exploit (May 2026)

avoid.net/thorchain-gg20-mpc-vault-exploit-may-2026→38/100·87% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4FCm1k…Bo6r

Summary

On May 15, 2026, THORChain suffered a targeted cryptographic exploit in which a malicious node operator reconstructed a full private key from a single Asgard vault by exploiting incremental key material leakage in the GG20 Threshold Signature Scheme, draining approximately $10.7 to $11 million across nine blockchain networks. The protocol executed an automated and community-coordinated emergency halt, published a formal exploit report on May 21, 2026, and resumed trading on June 23, 2026, after a 39-day shutdown and an 11-stage security overhaul. The incident is the third major security breach in THORChain's history and exposed systemic risks in GG20-based MPC implementations.

Connected Entities

13 entities · 60 linked investigations
Organizations
□Cosmos (ATOM)42□Ethereum64□THORChain□THORChain GG20 MPC Vault Exploit (May 2026)□Binance□Base□Monero
Tokens
♦Dogecoin♦Bitcoin♦Litecoin♦Bitcoin Cash
Wallets
◇DBLJWF…FCjS◇rwoGBr…bFBz
Relationships
  • DBLJWF…FCjS→mentioned with→THORChain GG20 MPC Vault Exploit (May 2026)(50%)
  • rwoGBr…bFBz→mentioned with→THORChain GG20 MPC Vault Exploit (May 2026)(50%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • Monero→mentioned with→Binance(70%)
  • Monero→mentioned with→Bitcoin(60%)
  • Litecoin→mentioned with→Bitcoin(70%)
  • Litecoin→mentioned with→Monero(65%)
  • Binance→mentioned with→Ethereum(65%)
  • THORChain→mentioned with→Monero(70%)
  • THORChain→mentioned with→Litecoin(60%)
  • + 22 more
Also appears in
Cosmos Hub·58Levana Perps·22Polygon·54Saga·32Secret Network / Axelar Bridge Exploit June 2026·8DEXX·10Cosmos (ATOM)·42dYdX V3·30Secret Network / Axelar IBC Bridge Exploit (June 2026)·8Harbor Protocol·28

Connected Through

10 shared actors · 628 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about THORChain GG20 MPC Vault Exploit (May 2026)?

Timeline(12 events)

29 June 2021

THORChain suffers first major exploit via fake deposit attack; approximately $350,000 lost.

SlowMist Analysis — Medium

16 July 2021

THORChain ETH Router exploit #1 drains approximately $8 million.

THORChain Post-Mortem — Medium

23 July 2021

THORChain ETH Router exploit #2 drains approximately $8 million; third incident in one summer.

THORChain Post-Mortem — Medium

November 2025

THORChain engages Silence Laboratories to develop a custom DKLS threshold signature implementation to replace GG20, targeting Q1/Q2 2026 delivery.

Cryptopolitan — THORChain node operators vote on network restart plan

13 May 2026

Malicious node operator (thor16ucjv3v695mq283me7esh0wdhajjalengcn84q) joins THORChain network with approximately 635,000 RUNE bonded collateral.

THORChain Exploit Report #1

15 May 2026

Exploit executed: attacker reconstructs full private key for one Asgard vault using GG20 key material leakage and drains approximately $10.7 to $11 million across at least nine blockchains.

CoinDesk — Thorchain halts trading after $10 million cross-chain exploit

15 May 2026

Automated solvency checker triggers within 52 minutes of exploit onset, halting signing and trading on Ethereum, Avalanche, BSC, Base, Dogecoin, and Cosmos chains. RUNE declines approximately 12%.

THORChain Exploit Report #1

15 May 2026

Node operators coordinate on Discord to issue manual pauses and Mimir governance votes; network-wide halt across trading, signing, chain observation, and churning achieved within approximately two hours.

THORChain Exploit Report #1

15 May 2026

Emergency patch v3.18.1 released to safeguard remaining vaults.

CryptoBriefing — THORChain resumes trading after five-week halt

21 May 2026

THORChain publishes Exploit Report #1, detailing the full incident timeline, GG20 vulnerability, and governance recovery pathway via ADR-028.

THORChain Exploit Report #1

22 May 2026

ADR-028 governance vote opened to node operators, proposing loss absorption through protocol-owned liquidity and a 10% bounty for fund return.

BanklessTimes — THORChain Opens ADR028 Vote

23 June 2026

THORChain resumes full trading after 39-day shutdown, completing an 11-stage reactivation process including security audits, vault migration, and node keyshare verification. RUNE trades near $0.42.

CryptoTimes — THORChain Reopens 39 Days After $10.7M Exploit
Provenance & Audit Trail
Anchored on SolanaVerify on-chain20 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 20 of 20 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 6/29/2026, 11:04:27 PM

last updated: 7/27/2026, 5:41:17 PM

3 views

avoid.net — verified advice for a post-truth world