Thunder Terminal
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 53. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −1.1; the penalty for incidents it suffered is capped at 20. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.1 |
| Sum | 44 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 53/100 (kept between 0 and 100)
How scoring works →Summary
Thunder Terminal is a Solana-based on-chain trading terminal that suffered a $240,000 exploit on December 27, 2023, when an attacker leveraged compromised MongoDB credentials to steal session tokens and drain 86.5 ETH and 439 SOL from 114 user wallets in under nine minutes. The attacker subsequently routed the stolen ETH through the Railgun privacy protocol and demanded a 50 ETH ransom for deletion of alleged user data, directly contradicting Thunder Terminal's public claim that no user data or private keys were compromised. Thunder Terminal pledged full reimbursement of stolen funds, engaged the FBI, and implemented additional security controls, though no public confirmation of completed reimbursements has been verified.
Connected Entities
5 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- Thunder Terminal→mentioned with→ZachXBT(70%)
- Thunder Terminal→mentioned with→Solana(75%)
- Thunder Terminal→mentioned with→Ethereum(60%)
- Thunder Terminal→mentioned with→Railgun(80%)
- Railgun→mentioned with→Ethereum(80%)
- Solana→mentioned with→Ethereum(60%)
Timeline(7 events)
19 December 2023
MongoDB discloses a breach of its own systems approximately eight days before the Thunder Terminal attack, which allegedly exposed Thunder Terminal's database connection credentials.
CoinSpeaker, The Crypto Times27 December 2023
Thunder Terminal exploit begins at 12:11:47 AM UTC. Attacker uses a stolen MongoDB connection URL to extract session tokens and execute unauthorized withdrawals from 114 wallets, draining 86.5 ETH and 439 SOL (~$240,000 total).
The Crypto Times, CoinSpeaker, Crypto.news27 December 2023
Attack concludes at 12:20:35 AM UTC — nine minutes after it began. Thunder Terminal detects the activity and revokes all session tokens and transaction signing capabilities to halt further withdrawals.
CoinSpeaker, Crypto.news27 December 2023
ZachXBT flags the suspicious activity on his Telegram channel and traces approximately 86.3–86.5 ETH being routed to the Railgun privacy protocol. The Block reports ZachXBT's findings.
The Block27 December 2023
Thunder Terminal issues a public incident report, stating no private keys or user wallets were compromised, and pledging full reimbursement of stolen funds plus 0% fees and $100,000 in platform credits for affected users.
CoinTelegraph, CryptoPotato27 December 2023
The attacker sends an on-chain message via Etherscan demanding 50 ETH (~$110,000) ransom for deletion of alleged stolen user data, calling Thunder Terminal's public statements 'all lies.'
CoinTelegraph, Milk Road27 December 2023
Thunder Terminal contacts the FBI and its legal team. Representative 'Jackson' confirms FBI active involvement. Platform implements 2FA for withdrawals and initiates a full security audit.
CryptoPotato, BankInfoSecurityDecision Log
- slot 455366338 · hash 53a2f1ofaXCPyEERveyKGCBx391C27bu6oyjuWncRj4p
- slot 420801815 · hash 9xHqUks9f7xr689yyLGbjZ7obT2qEgk5d6kHaMqKFdGy
This investigation is cryptographically anchored to the Solana blockchain (2 decisions).
model: claude-sonnet
generated: 5/4/2026, 4:05:04 PM
last updated: 10/10/2026, 6:46:28 PM
9 viewsavoid.net — verified advice for a post-truth world