THORChain
RUNEDecentralized Liquidity Network
News Heat Trend
Project Overview
THORChain is a decentralized cross-chain AMM trading protocol, created by a group of anonymous cryptocurrency developers at Binance's Hackathon in 2018. Its aim is to decentralize cryptocurrency liquidity via a network of public THORNodes and ecosystem products. Access to its native and cross-chain liquidity is open to any person, product, or institution.
Hacker Deposits 229.72 ETH, Valued at $445,000, from Coldcard Attack Involving Approximately 30 BTC into Duel.comcasino
Odaily News: According to monitoring by Galaxy's Head of Research, a victim's Coldcard wallet was compromised in a hacker attack involving nearly 30 BTC, of which 17 BTC were swapped for ETH via THORChain and subsequently deposited into Duel.comcasino. The victim and a researcher have sent emails to all known addresses associated with Duel.comcasino, requesting that the relevant funds be frozen, and provided all transaction and deposit information. The hacker deposited 229.72497255 ETH, valued at $445,000, into Duel.comcasino—funds originating from the Coldcard attack involving approximately 30 BTC. The victim stated that Duel.comcasino responded by saying that the police would need to contact their team. Duel.comcasino's anti-money laundering policy claims it enforces Know Your Customer (KYC) procedures and complies with all applicable laws. Duel.comcasino was notified within minutes of the deposit being completed. To date, Duel.comcasino has not frozen the relevant funds. Since most of the Western world had already passed midnight at the time of the incident, police reports cannot be filed until at least Monday. If Duel.comcasino fails to freeze the funds, the victim will pursue legal action against them. Duel.comcasino's X account has been suspended, and Galaxy's Head of Research has also flagged individuals on X suspected of being associated with the platform, including team members and dealers: @korraflow, @atrois7, @MiaMalkova.
THORChain Resumes Trading After $10.7 Million Attack
Odaily, the decentralized cross-chain liquidity protocol THORChain has resumed trading after being down for over five weeks following a May attack. Signing, swapping, liquidity provider operations, and redemptions have all been restored.On May 15, blockchain investigator ZachXBT and security firm PeckShield identified that the protocol had likely been exploited, prompting THORChain to halt trading. The vulnerability resulted in a loss of approximately $10.7 million from one of its six Asgard vaults, while the other five vaults were unaffected.THORChain stated that each vault has now been verified, and every key share has been cross-checked. Native Monero swaps are currently undergoing end-to-end testing and will be launched subsequently. (The Block)
THORChain Releases Security Incident Update: Losses to Be Absorbed Through Protocol-Owned Liquidity, Attacker Node Fully Slashed
THORChain has released its fourth update regarding the Asgard vault intrusion incident, publishing the ADR028 proposal and opening voting for node operators. The proposal indicates that the protocol will first absorb losses through its Protocol-Owned Liquidity (POL), with the remaining portion to be borne by synthetic asset holders. The exact proportion is still under evaluation. The POL will be reduced to zero as a result, and the proposal suggests allocating a portion of system revenue over time to gradually replenish it. This plan does not involve minting new RUNE, selling RUNE, or diluting holder equity.On the technical side, the GG20 version will be temporarily retained with a patch upgrade. Trading will resume after the vulnerability is fixed and a successful node rotation is completed. A slower, more security-focused release cadence is planned for the future.Regarding the slashing mechanism, unrelated nodes sharing the same vault as the attacker will be protected, while the attacker's node will be fully slashed. The recovered RUNE will be paired with recoverable assets from the affected vault, and any excess RUNE will be burned.Additionally, THORChain has offered a white-hat bounty to the attacker to recover funds. If a portion of the funds is recovered, the recovery plan will be adjusted proportionally. THORChain emphasizes its commitment to remaining neutral and permissionless, stating it will not censor the attacker's swap transactions after trading resumes.Currently, node operators are voting on the overall direction and principles of the proposal. The specific figures in the ADR are indicative and will be adjusted later via the Mimir mechanism. The goal is to restart the network as soon as possible. A "yes" vote means developers can proceed further along this path.
THORChain: No Refund, Airdrop, or Compensation Plan Has Been Initiated; Community Warned to Beware of Scams
Odaily News: THORChain officially stated that a large number of fake accounts and false information have been spotted on the market, involving activities such as "refunds," "airdrops," and "compensation." Preliminary investigations indicate that user funds were not compromised in the previous security incident. No refund, airdrop, or compensation plan has been initiated. Any accounts claiming otherwise are imposters or are disseminating false information. Further investigation progress and additional details will be announced subsequently.
THORChain: Network Paused Due to Security Incident, Suspected Single Malicious Node Exploiting GG20 TSS Vulnerability to Steal Funds
Odaily Odaily, THORChain posted on platform X that its developers have released an incident update on Discord. Current evidence points to a node thor16uc...cn84q, which recently joined the network, as being associated with the attack. This node is operated by a single malicious actor. The primary hypothesis is that the attacker exploited a vulnerability in the GG20 TSS implementation, causing sensitive key material of vault participants to leak over time. This ultimately enabled the reconstruction of the vault's private key and the execution of unauthorized outgoing transactions.Regarding network status, the network has been paused after multiple node operators executed `make pause`. RUNE transfers and on-chain observation may resume within approximately 12 hours, but transactions, LP operations, signing, and other sensitive operations remain paused.Discussed recovery plans include slashing the affected node's bond, covering losses with protocol-owned liquidity (POL), or other community-driven solutions. THORSec and Outrider Analytics are continuing their investigation. The Treasury is gathering forensic data and coordinating with relevant law enforcement agencies. Full functional recovery is expected to take several days or longer.
THORChain: Asgard Vault Breach Results in Approximately $10.7 Million Loss; User Cross-Chain Transactions Unaffected for Now
According to Odaily, THORChain has issued an emergency announcement stating that after discovering a suspected breach of an Asgard vault, the network has suspended trading operations to respond to the security incident. Preliminary information indicates that user funds remain unaffected, with losses primarily concentrated on the protocol's own capital.The official statement noted that the system automatically detected anomalous behavior and halted signing operations, thereby alerting the community and preventing further asset outflow. The investigation is currently ongoing to determine the root cause of the vulnerability and the full scope of the impact.Known information indicates that this incident involves one of the six Asgard vaults, with estimated losses of approximately $10.7 million. Meanwhile, staked RUNE on the affected nodes has been slashed due to a penalty mechanism triggered by unauthorized outgoing transactions. The network has paused churn operations and delayed the launch of new chains and related features until system stability is restored.THORChain stated that no user cross-chain transactions have been affected so far and has requested node operators to thoroughly inspect their infrastructure, secure key management, and anomalous behavior, and to submit relevant logs to assist the investigation.
ZachXBT: Stolen funds from Binance and Bitget flow into the same address, suspected work of the same hacker
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
ZachXBT: Stolen funds from Binance and Bitget hacks flowed into the same address, likely the work of the same attacker
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
A mysterious entity bought 3,000.5 ETH, with cumulative transaction value reaching $7.06 million
according to on-chain analyst Ai Yi, a mysterious entity whose funding source is Tornado has cumulatively bought 3,000.5 ETH worth $7.06 million since October 23, and subsequently swapped it for BTC via the cross-chain protocol THORChain. The entity had previously sold ETH in batches at price highs and bought back near recent lows: it sold at $3,109 in January 2026, sold again at $2,679 in September 2026, and bought back at $2,353 in October 2026.
THORChain Earns Nearly $10 Million in Fees in 10 Days, Accused of Funneling Most of Bybit's Stolen Funds
Odaily News: According to on-chain analyst Yu Jin, over 90% of the funds swapped cross-chain through THORChain are illicit or grey-market funds. Yu Jin stated that most of the funds stolen from Bybit last year were transferred through THORChain, which collected nearly $10 million in fees within 10 days. Recently, some of the funds stolen from Bitget have also been transferred through THORChain, generating $1 million in fee revenue.
In 4 Days, a Whale Spent 85.42 Million USDC to Cross-Chain Buy 1,075.6 BTC
Odaily reports, according to on-chain analyst Yu Jin's monitoring, a whale completed a cross-chain BTC purchase 2 hours ago. Over the past 4 days, this whale spent a total of 85.42 million USDC to buy 1,075.6 BTC, with an average cost of $79,412, including approximately $170,000 in swap fees paid to THORChain.
Spent 60.37 million USDC in two days, a whale bought 767.8 BTC through THORChain
According to on-chain analyst Yu Jin's monitoring, a whale continued to buy 544.5 BTC via cross-chain today, worth $42.43 million. Over the past two days, this whale has swapped 60.37 million USDC for 767.8 BTC through THORChain, at an average price of approximately $78,628.
ZachXBT: Stolen funds from Binance and Bitget flow into the same address, suspected work of the same hacker
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
ZachXBT: Stolen funds from Binance and Bitget hacks flowed into the same address, likely the work of the same attacker
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
Stealing $351.6 Million: Bitget Hacker Swaps ETH for BTC via THORChain
Odaily reports, according to Lookonchain monitoring, the Bitget hacker (0xf7bC...96C3) swapped ETH for BTC via THORChain, having stolen $351.6 million.
THORChain Earns Nearly $10 Million in Fees in 10 Days, Accused of Funneling Most of Bybit's Stolen Funds
Odaily News: According to on-chain analyst Yu Jin, over 90% of the funds swapped cross-chain through THORChain are illicit or grey-market funds. Yu Jin stated that most of the funds stolen from Bybit last year were transferred through THORChain, which collected nearly $10 million in fees within 10 days. Recently, some of the funds stolen from Bitget have also been transferred through THORChain, generating $1 million in fee revenue.
Slow Mist's Cosine Talks About THORChain: Decentralization Is Not Just a Slogan, and "Decentralized, No Right to Interfere" Should Not Be Used to Respond to Industry Security Incidents
Slow Mist's Cosine posted on X platform, stating that the Bitget hack incident has spread widely, involves a huge amount of funds, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Cosine pointed out that when THORChain itself previously suffered a hack, it also quickly intervened in its so-called "decentralized" platform; but this time, when facing a major industry security incident, it responded on the grounds of being "decentralized and having no right to interfere," likened itself to Bitcoin and Ethereum, and continued to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan. After major security incidents occur, the key is to distinguish which issues need to be solved jointly by the industry. He also believes that platforms such as THORChain should not be easily mentioned in the same breath as Bitcoin and Ethereum, as there are clear differences in the degree of decentralization and mechanisms among different systems.
THORChain addresses questions regarding the Bitget security incident, emphasizing the permissionless nature of decentralized protocols.
MistTrack (@MistTrack_io) disclosed that, following the transfer of nearly $1.2 billion in stolen funds from last year's $1.46 billion Bybit hack via THORChain, Bitget has recently suffered another major security breach, with stolen funds suspected of again flowing through THORChain. In response, the official THORChain team stated that its protocol is a decentralized, permissionless network, just like Bitcoin, Ethereum, and BNB Chain.
ZEC Liquidity Pool Goes Live, THORChain Native Zcash Trading to Enter Next Phase
THORChain has announced that the ZEC liquidity pool is now live. The network completed a node churn, and all nodes have begun monitoring the Zcash chain. THORChain stated that trading functionality will be the next step; current liquidity is relatively shallow, and early traders should be aware of risks such as slippage. Previously, THORChain added native Zcash support in a protocol upgrade, including UTXO handling, RPC logic, and a ZEC price oracle, and continues to advance mainnet integration.
XMR, ZEC can be natively exchanged for BTC, ETH, and stablecoins; THORChain launches version 3.20
Odaily News: THORChain announced the launch of version 3.20, adding native cross-chain swap support for Monero (XMR) and Zcash (ZEC). Users can directly swap XMR and ZEC for Bitcoin, ETH, and stablecoins without wrapping assets, registering on centralized exchange accounts, or relinquishing asset custody. This upgrade also introduces Protocol-Owned Liquidity (POL) and Stable Reserve, and restores support for Solana, Base, and BNB. Among these, Stable Reserve supports zero-liquidity-fee swaps between stablecoins.
$282 Million in Bitcoin and Litecoin Stolen in Trezor Impersonation Support Scam
Odaily News, January 10 - A Bitcoin and Litecoin holder provided a 12-word recovery phrase to attackers impersonating Trezor support personnel, resulting in the theft of approximately $282 million in assets, including about $139 million in Bitcoin and $153 million in Litecoin. Blockchain forensics firm ZeroShadow stated that the incident stemmed from a social engineering attack, not a compromise of wallet software or private key infrastructure. The stolen funds were split via the THORChain cross-chain bridge within minutes and converted into Monero through instant exchange services. ZeroShadow's monitoring team flagged and froze approximately $700,000 in funds within 20 minutes. Under the BIP39 standard, a 12-word recovery phrase contains approximately 128 bits of entropy, while a 24-word phrase contains 256 bits of entropy. Chainalysis estimates that up to 23% of all mined Bitcoin is permanently inaccessible due to lost keys, involving millions of BTC, with causes including forgotten recovery phrases, damaged backups, and a lack of inheritance planning.
hinkal will fully compensate user funds, confirming approximately 797,000 USDC was extracted by an attacker and swapped for 454 ETH
decentralized privacy protocol hinkal has released an update on a security incident, confirming that an attacker extracted approximately 797,000 USDC from its Ethereum contract through a series of transactions and exchanged it for about 454 ETH. Of this, roughly 410 ETH was subsequently transferred to Tornado Cash, while the remaining approximately 44.67 ETH was bridged to the Bitcoin network via THORChain. hinkal is currently collaborating with an external security team to trace the flow of funds.hinkal stated that the impact of this security incident is limited to the relevant fund pools on the Ethereum chain, and contracts on other chains remain unaffected. However, all contracts have been temporarily suspended for fixes and security verification. All affected users will be fully compensated at a 1:1 ratio, with specific compensation procedures and timelines to be announced in a subsequent update.
THORChain Resumes Trading After $10.7 Million Attack
Odaily, the decentralized cross-chain liquidity protocol THORChain has resumed trading after being down for over five weeks following a May attack. Signing, swapping, liquidity provider operations, and redemptions have all been restored.On May 15, blockchain investigator ZachXBT and security firm PeckShield identified that the protocol had likely been exploited, prompting THORChain to halt trading. The vulnerability resulted in a loss of approximately $10.7 million from one of its six Asgard vaults, while the other five vaults were unaffected.THORChain stated that each vault has now been verified, and every key share has been cross-checked. Native Monero swaps are currently undergoing end-to-end testing and will be launched subsequently. (The Block)
THORChain: ZEC Listing Delayed Due to Recent Zcash Vulnerability Disclosure
According to the THORChain blog, ZEC is in the queue for launch on THORChain. However, due to a recent vulnerability disclosed in Zcash—whose existing patch impacts integrators’ normal operations—THORChain must first complete a minor code modification to its Bifrost module before proceeding. The development team stated that the change is minimal but must be completed prior to ZEC’s launch. Monero (XMR) is currently expected to launch by the end of this month, with ZEC scheduled to follow.
Related news
ZachXBT: Stolen funds from Binance and Bitget flow into the same address, suspected work of the same hacker
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
ZachXBT: Stolen funds from Binance and Bitget hacks flowed into the same address, likely the work of the same attacker
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
A mysterious entity bought 3,000.5 ETH, with cumulative transaction value reaching $7.06 million
according to on-chain analyst Ai Yi, a mysterious entity whose funding source is Tornado has cumulatively bought 3,000.5 ETH worth $7.06 million since October 23, and subsequently swapped it for BTC via the cross-chain protocol THORChain. The entity had previously sold ETH in batches at price highs and bought back near recent lows: it sold at $3,109 in January 2026, sold again at $2,679 in September 2026, and bought back at $2,353 in October 2026.
Tether Freezes THORChain-Associated USDT Vault Without Warning
Tether temporarily froze approximately 1.45 million USDT related to THORChain vaults, and unfroze them two hours later without explanation.
ZEC Liquidity Pool Goes Live, THORChain Native Zcash Trading to Enter Next Phase
THORChain has announced that the ZEC liquidity pool is now live. The network completed a node churn, and all nodes have begun monitoring the Zcash chain. THORChain stated that trading functionality will be the next step; current liquidity is relatively shallow, and early traders should be aware of risks such as slippage. Previously, THORChain added native Zcash support in a protocol upgrade, including UTXO handling, RPC logic, and a ZEC price oracle, and continues to advance mainnet integration.
Stealing $351.6 Million: Bitget Hacker Swaps ETH for BTC via THORChain
Odaily reports, according to Lookonchain monitoring, the Bitget hacker (0xf7bC...96C3) swapped ETH for BTC via THORChain, having stolen $351.6 million.