Vultisig

ZachXBT

THORChain

THORChain Yield

<p>John-Paul Thorbjornsen, “JP Thor,” Co-Founder of THORChain and Vultisig, was scammed out of about $1.3 million by North Korean hackers. The attack happened through a conference call scam involving a hacked Telegram account, a fake Zoom link, and even a deepfake video of a friend.</p>
<p>On X, on-chain analyst ZachXBT said, “JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits. So it’s a bit poetic he got rekt here by DPRK.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The wallet likely belongs to <a href="https://twitter.com/jpthor?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@jpthor</a> who had a private wallet compromised due to a fake meeting scam a few days ago. <br><br>JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits. <br><br>So it’s a bit poetic he got rekt here by DPRK. <a href="https://t.co/T57RRJ0bbf" rel="noopener noreferrer nofollow">pic.twitter.com/T57RRJ0bbf</a></p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1966415195137519909?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 12, 2025</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="how-the-attack-happened">How the Attack Happened?</h2>
<p>Confirming the $1.3M loss, John <a href="https://x.com/jpthor/status/1966450439437611484" target="_blank" rel="noopener noreferrer nofollow">emphasized</a> that hackers gained access to old private keys stored in his iCloud Keychain, which allowed them to drain an old MetaMask wallet he had forgotten about. He emphasized that the attack required no transaction signing, pointing to the likelihood of a 0-day exploit.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Ok so this attack finally manifested itself. <br><br>Had an old metamask cleaned out (which I forgot about, it was staking some assets which don’t appear on etherscan unless you use portfolio tracking sites)<br><br>Summary <br>1) friend’s hacked telegram account + deep-fake video on zoom<br>2)… <a href="https://t.co/bjqqFZ5ddB" rel="noopener noreferrer nofollow">https://t.co/bjqqFZ5ddB</a></p>— JP (@jpthor) <a href="https://twitter.com/jpthor/status/1965366373682491647?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 9, 2025</a>
  </blockquote>
 </div>
</figure>
<p>This is not the first time John has been attacked. On September 6, he <a href="https://x.com/jpthor/status/1964329946060324915" target="_blank" rel="noopener noreferrer nofollow">revealed</a> he was targeted on his Mac workstation. He noticed a strange pop-up, then heard the Finder “download” sound.&nbsp;</p>
<p>A script was copying his entire Documents folder into a temporary directory, likely preparing it for upload. John disconnected from the internet, wiped his Mac, and reset it. He also decided to disable iCloud syncing for sensitive documents.</p>
<p>A few days later, he <a href="https://x.com/jpthor/status/1964886838990000200" target="_blank" rel="noopener noreferrer nofollow">traced</a> the breach back to the Zoom link from his friend’s hacked Telegram.</p>
<p>The Zoom link was official, and John even joined through his browser, not the app. He saw a deepfake video of his friend, but within two minutes, a malicious script had already been downloaded. That script started copying his iCloud Documents folder.</p>
<h2 class="wp-block-heading" id="lessons-and-warnings">Lessons and warnings</h2>
<p>Following the incident, John <a href="https://x.com/jpthor/status/1964346291795693943" target="_blank" rel="noopener noreferrer nofollow">warned</a> that private keys remain permanently unsafe, even when forgotten. He urged crypto users to abandon traditional wallets in favor of multi-factor wallets, which split key shares across multiple devices. John noted that while his MetaMask wallet was drained, his Vultisig wallets remained untouched.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also Read: <a href="https://www.cryptotimes.io/2025/09/12/radiant-hacker-moves-26-7-million-in-stolen-funds-to-ethereum/" target="_blank" rel="noopener noreferrer nofollow">Radiant Hacker Moves $26.7 Million in Stolen Funds to Ethereum</a></p>
</blockquote>

THORChain Co-Founder Hit by $1.3M Scam Using Zoom Call Scam

Table of Contents

The Crypto Times

Other articles published on Sep 12, 2025

Join our free newsletter for daily crypto updates!