Tools Crypto Exploit Tracker exploit-0044
Exploit record
THORChain
- Loss
- $11M
- Attack vector
- Private Key Compromise
- Chain
- Multichain
- Sector
- DEX
What happened
On 15 May 2026 an attacker drained about $10.7 million from one of THORChain's five Asgard vaults across Bitcoin, Ethereum, Base and BNB Chain, crashing RUNE around 15%.
The attacker was a newly churned node operator who had joined the network two days earlier; the working theory supported by PeckShield, Cyvers and THORChain's own report is that vault key material leaked through a vulnerability in the GG20 threshold signature scheme implementation during keygen or signing rounds. Node operators paused the network within hours via the Mimir governance module, and trading resumed after a five-week halt alongside a $10 million compensation portal for affected users.
Sources
- THORChain exploit reportthorchain.org/blog/thorchain-exploit-report-1
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026