THORChain Resumes Operations Following $10M Security Breach

THORChain restores trading after a $10.7M exploit, completes vault checks, and plans Zcash, Monero, plus TAO support after its restart.

Areeba Rashid
June 24, 2026
1:00 am

Areeba Rashid

Areeba Rashid is a dedicated crypto news writer with a passion for making complex topics accessible to everyone. She covers the latest developments in the crypto world, including in-depth price analysis, helping readers stay informed and make sense of market trends.

THORChain restored trading and swaps after weeks of checks tied to a $10.7M exploit.
The protocol retired legacy vaults after KeyVerify checks and node keyshare reviews.
THORChain plans Zcash, Monero, and TAO support after completing its network restart.

THORChain restored network activity on Tuesday after a $10.7 million exploit caused a trading halt on May 15. The protocol said trading, signing, swaps, and liquidity actions were online again. The restart followed weeks of security checks and network upgrades.

The recovery focused on vault safety and node verification. On Sunday, THORChain said most vaults had passed checks through KeyVerify. It also retired remaining legacy vaults during migration to a new vault set.

Trading is live again on THORChain.

After more than a month offline, the network is fully back. Signing, churning, secured and trade assets, LP actions, and swaps are all up and running. The world's leading Bitcoin DEX is open for business once again.

This recovery was never…
— THORChain (@THORChain) June 23, 2026

Also Read: ICE and OKX Launch Joint Venture to Build Tokenized Financial Markets

THORChain Vault Migration Marks Key Recovery Step

THORChain called the vault migration its most important recovery milestone. It said every node’s keyshare was completed on Friday. Those checks came before core network services were restored to users.

The May exploit was tied to the GG20 threshold signature scheme. THORChain uses that system to secure vaults by splitting key control among node operators. The protocol said the weakness exposed key material over time.

According to THORChain, a malicious node operator used that leakage to rebuild a full private key. That access enabled the $10.7 million theft. The incident forced a trading pause while developers reviewed affected systems.

Developers issued an emergency patch on May 20 to protect remaining vaults. A June 9 upgrade included a fix for the exploited GG20 issue. Another upgrade followed on June 11 with stability fixes and KeyVerify improvements.

THORChain Outlines New Asset Support After Restart

THORChain is a major native cross-chain swap protocol. It allows users to trade assets across networks such as Bitcoin and Ethereum. Its role has drawn attention from investigators tracking stolen crypto.

Investigators have scrutinized cross-chain tools because hackers use them to move funds between blockchains. THORChain has appeared in such tracking work before. The restart may keep attention on its security controls.

After restoring operations, THORChain outlined new integrations. The protocol said native swaps and vaults for Zcash are expected within two weeks. It said Monero support will follow after the Zcash launch.

THORChain also plans to add support for Bittensor’s TAO token. The protocol placed that launch about six weeks after the restart. It did not give a final launch date.

The restart closes a phase in THORChain’s recovery from the exploit. The protocol moved from emergency containment to verified vault migration. THORChain said the recovery process is now largely complete.

Also Read: Altura CEO Confirms Vault Wind-Down After $8.5M Redemption Surge Hits