THORChain Resumes Trading After $10.7M Exploit

The THORChain decentralized exchange has fully restored trading and core network functions after a month-long suspension triggered by a major security exploit. The cross-chain liquidity protocol announced the resumption of operations on Tuesday, June 23, 2026, ending a halt that began on May 15.

The shutdown followed an attack that drained approximately $10.7 million from one of the network's six Asgard vaults. According to the protocol, the exploit stemmed from a vulnerability in its GG20 threshold signature scheme, a system designed to distribute control of vault keys among multiple node operators. A malicious node operator was able to progressively leak key material and reconstruct a full private key, enabling the theft.

In the weeks following the incident, THORChain prioritized security over speed in its recovery process. Officials stated that every vault was verified and every node's keyshare was checked before services were restored. The protocol confirmed the safety of most vaults through its KeyVerify protocol, retired remaining legacy vaults, and migrated assets into a new vault set. This migration was described as a significant milestone in re-establishing the...