THORChain Launches $10M Recovery Portal After Exploit Impacting Over 12,000 Wallets

THORChain has confirmed a $10 million exploit and introduced a recovery portal that allows affected users to revoke malicious token approvals and submit compensation claims through a self-custodial process.

In a post published on X on Saturday, the THORChain Foundation announced that impacted users can now verify their compensation eligibility and begin the claims process following the attack.

According to the recovery portal and a post-mortem analysis by blockchain security firm PeckShield, suspicious outbound transactions were first detected at 02:14 UTC on May 11 after node operators identified abnormal activity on the network. THORChain reportedly paused trading and outbound signing operations within eight minutes of detection.

The exploit resulted in the theft of approximately 36.75 BTC, valued at nearly $3 million, along with an additional $7 million worth of digital assets across Ethereum, BNB Chain, and Base. In total, 12,847 wallets across four blockchain networks were affected.

THORChain Opens 21-Day Refund Window

THORChain stated that affected users have 21 days to submit compensation claims through the recovery portal. The claims period will officially close on June 4.

Any funds that remain unclaimed after the deadline will be transferred into the protocol’s insurance fund, according to the announcement.

The protocol also emphasized that the refund pool has been fully provisioned by the treasury, matching the total estimated losses from the exploit.

How the THORChain Exploit Happened

In its latest incident update, THORChain said the leading theory behind the exploit involves a vulnerability in the GG20 Threshold Signature Scheme (TSS) implementation used within the protocol’s vault infrastructure.

The flaw allegedly allowed sensitive vault key material to leak gradually over time. By collecting enough leaked data, the attacker was reportedly able to reconstruct the vault’s private key and authorize unauthorized outbound transactions.

THORChain further revealed that a newly churned node joined the network several days before the exploit and is currently suspected to be linked to the attack. Onchain investigations reportedly identified connections between the node’s bonding addresses and wallets that received the stolen funds.

“The Treasury is actively collecting forensic data and coordinating with Outrider Analytics and relevant law enforcement agencies in an effort to identify the attacker and pursue recovery of stolen funds where possible,” the protocol stated.

Crypto Hack Losses Continue Rising in 2025

The THORChain exploit comes amid a broader rise in crypto-related security breaches throughout 2025.

According to industry data, crypto hacks and exploits resulted in approximately $629.7 million in losses during April alone, marking the industry’s worst month since February 2025, when losses exceeded $1.47 billion.

Major incidents including the KelpDAO exploit, which reportedly caused $293 million in damages, and Drift Protocol’s $280 million hack accounted for the majority of April’s losses.

Security analysts have noted a growing shift in attack patterns across decentralized finance (DeFi), with infrastructure vulnerabilities, bridge exploits, operational weaknesses, and privileged access compromises becoming more common than traditional smart contract exploits.