insurance

Ponzi

Drift

DeFi

THORChain

THORChain has confirmed a $10 million exploit and launched a recovery portal, giving affected users a self-custodial path to revoke malicious token approvals and submit refund claims backed by a treasury-provisioned refund pool of equal size.
In a Saturday post on X, THORChain Foundation <a href="https://x.com/thorchnfnd/status/2055428816072294481" rel="noopener noreferrer nofollow">introduced</a> the recovery portal, saying that “affected users are now able to check what they will be paid as compensation following the exploit.”
The portal, citing a PeckShield post-mortem, claims that the attack was detected at 02:14 UTC on May 11, when node operators flagged anomalous outbound transactions. <a href="https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit?utm_campaign=rss_partner_inbound&amp;utm_medium=rss&amp;utm_source=rss_feed" rel="noopener noreferrer nofollow">Trading and outbound signing were paused</a> within eight minutes. In total, attackers drained 36.75 BTC, worth around $3 million, and approximately $7 million in tokens across BNB Chain, Ethereum and Base, hitting 12,847 wallets across four chains.<img alt="THORChain confirms $10M exploit, rolls out recovery portal for affected users" height="1490" src="https://s3-images.ctmedia.io/media/content/revok323.png" width="1614">
THORChain’s recovery portal. Source: THORChain
Affected users have 21 days to submit claims. The refund window closes on June 4, after which any unclaimed allocation rolls over to the protocol’s insurance fund.
Related: <a href="https://cointelegraph.com/news/grinex-hack-14m-crypto-exchange-suspends-trading" rel="noopener noreferrer nofollow">Russia-linked crypto exchange Grinex halts trading after $14M hack</a>
<h2 id="how-thorchain-was-drained">How THORChain was drained</h2>
In an incident update, THORChain <a href="https://x.com/THORChain/status/2055376254514196749" rel="noopener noreferrer nofollow">said</a> the leading theory is that the attacker exploited a vulnerability in the GG20 threshold signature scheme (TSS) implementation, which allowed sensitive vault key material to leak gradually. By accumulating enough of this leaked data over time, the attacker was able to reconstruct the vault’s private key and authorize unauthorized outbound transactions.
The protocol also noted that a newly churned node entered the network several days before the attack and is currently believed to be associated with it, with onchain links identified between the node’s bonding addresses and the wallets that received the stolen funds.
“The Treasury is actively collecting forensic data and coordinating with Outrider Analytics and relevant law enforcement agencies in an effort to identify the attacker and pursue recovery of stolen funds where possible,” the protocol wrote.
Related: <a href="https://cointelegraph.com/news/law-enforcement-freezes-millions-connected-to-crypto-ponzi-collapse" rel="noopener noreferrer nofollow">Law enforcement freezes $41M connected to $150M crypto Ponzi collapse</a>
<h2 id="crypto-hack-losses-hit-630-million-in-april">Crypto hack losses hit $630 million in April</h2>
Crypto hacks surged in April, with total losses <a href="https://cointelegraph.com/news/crypto-hacks-cause-630m-losses-in-april-highest-since-february-2025" rel="noopener noreferrer nofollow">reaching $629.7 million</a>, the worst month for the industry since February 2025, when $1.47 billion was stolen. KelpDAO’s <a href="https://cointelegraph.com/news/restaking-platform-kelp-exploited-293-million" rel="noopener noreferrer nofollow">$293 million exploit</a> and <a href="https://cointelegraph.com/news/drift-280-million-hack-questions-circle-response" rel="noopener noreferrer nofollow">Drift Protocol’s $280 million</a> hack drove the bulk of the damage, together representing 82% of April’s losses and cementing DeFi as the most targeted sector.
The pattern of attacks points to a shift in how protocols are being compromised, with bridges, privileged access and operational failures increasingly at the root of major incidents rather than straightforward smart contract bugs.
Magazine: <a href="https://cointelegraph-magazine.com/exploits-uncovered-by-ai-could-kill-defi-unless-projects-act-now/" rel="noopener noreferrer nofollow">AI-driven hacks could kill DeFi — unless projects act now</a>

THORChain confirms $10M exploit, rolls out recovery portal for affected users

Table of Contents

Cointelegraph

Other articles published on May 16, 2026

Join our free newsletter for daily crypto updates!