THORChain Resumes Trading After $10.7 Million Exploit and Major Security Fixes

THORChain has resumed trading and all network activity more than five weeks after a $10.7 million exploit forced the protocol to suspend operations on May 15. The decentralized cross-chain trading platform confirmed that swaps, liquidity provider actions, signing and trading services are now fully active again following a series of security upgrades and system checks.

The protocol said the attack was caused by a vulnerability in its GG20 threshold signature scheme, a system used to secure vaults by splitting private key control among different node operators. According to THORChain, the flaw allowed a malicious node operator to gradually rebuild a full private key through what developers described as “progressive key material leakage,” leading to the theft of funds.

To protect remaining assets, THORChain deployed an emergency patch on May 20 before releasing further upgrades on June 9 and June 11. The project also migrated old legacy vaults into a new verified vault system using the KeyVerify protocol.

THORChain said support for Zcash, Monero and Bittensor integrations is expected in the coming weeks.