A malicious validator node drained $10.8 million from THORChain's Asgard vault on May 15, 2026, exploiting a flaw in the GG20 threshold signature scheme across nine blockchains. The protocol froze all trading and signing operations for 13 hours. TRM Labs confirmed outflows across Bitcoin, Ethereu...
"This could be a MPC exploit involving GG20. Historically, GG18/GG20-family protocols have faced critical vulnerabilities, including CVE-2023-33241 and TSSHOCK." — Charles Guillemet, CTO, Ledger
A malicious validator node drained $10.8 million from THORChain's Asgard vault on May 15, 2026, exploiting a flaw in the GG20 threshold signature scheme across nine blockchains. The protocol froze all trading and signing operations for 13 hours. TRM Labs confirmed outflows across Bitcoin, Ethereum, BNB Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP. No attribution to a specific threat actor has been made.
The incident is the fifth major exploit against THORChain since 2021, bringing cumulative losses to approximately $25 million according to TRM Labs. It compounds a record year for cross-chain bridge attacks: Peckshield tracked eight bridge exploits totaling $328.6 million through mid-May 2026, with total DeFi hack losses exceeding $1 billion in the first four months of the year.
THORChain's community is now voting on ADR028, a recovery proposal that would absorb losses through Protocol-Owned Liquidity without minting new RUNE tokens. A refund portal for the 12,847 affected wallets closed claims on June 4.
The attacker operated as a recently churned validator node (address: thor16ucjv3v695mq283me7esh0wdhajjalengcn84q) that joined THORChain's active set days before the exploit. Chainalysis traced the pre-attack infrastructure: funds moved from Monero through Hyperliquid for USDC conversion, then to Arbitrum and Ethereum, where they were used to bond RUNE for the malicious node.
The GG20 threshold signature scheme distributes vault key control across multiple node operators so no single participant holds the full private key. The vulnerability exploited here involved progressive leakage of vault key material during keygen or signing rounds. According to analysis from PeckShield and Cyvers, the technique resembles the TSSHOCK class of attacks first disclosed at Black Hat USA 2023 by Verichains.
TSSHOCK demonstrated that a single malicious co-signer could extract private keys in one to two signing ceremonies through three attack vectors — α-shuffle, c-split, and c-guess — with no aborts triggered. The protocol continues operating normally while key material leaks, leaving no visible trace.
In THORChain's case, the attacker reconstructed sufficient key shards offline to forge outbound signatures from the Asgard vault without triggering quorum checks. From the network's perspective, the transactions appeared legitimate.
THORChain developers confirmed they had been preparing a migration from GG20 to a DKLS-based system built with Silence Laboratories. The upgrade was not deployed in time. Security researchers have since criticized the protocol's decision under ADR028 to retain GG20 with patches rather than accelerate the DKLS migration.
TRM Labs confirmed outflows across nine chains. The primary losses by value:
| Chain | Amount | USD Value | |-------|--------|-----------| | Ethereum | 3,443 ETH | $7.77M | | Bitcoin | 36.85 BTC | $2.97M | | BNB Chain | 96.6 BNB | $66K | | Other chains (5) | Various | ~$0.99M | | Total | — | ~$10.8M |
Identified attacker wallets include:
bc1ql4u94klk265lnfur2ujk9p6uh52f2a8jhf6f370x82fc0d5150f3548027e971ec04c065f3c93154eb and 0xd477b69551f49c0519f9b18c55030676138890bdDBLJWFemMHbduKofBRg6TJ9XFAgWdvFCjSltc1qg0h4rz5kf27fkr99gamw4heg20rfz5epd7m7whrwoGBrYEJ28jhBjchrTyCGXd1Pt4pobFBzqpp775v2je9texcv54rhd6kl9pfudy2nyyz4df2uvcTRM Labs stated it "has not attributed the May 15 exploit to a specific actor" as of publication. Forensic partnerships with THORSec, Outrider Analytics, Chainalysis, PeckShield, Cyvers, and Arkham Intelligence are ongoing.
| Time (UTC) | Event | |------------|-------| | May 15, 09:45 | ZachXBT flags unusual Asgard vault outflows (~$7.4M initially) | | May 15, ~10:30 | Total confirmed outflows climb to $10.8M | | May 15, Block 26190429 | Emergency pause executed: all trading, swaps, and signing frozen | | May 15, Block 26191149 | Scheduled pause window ends (13 hours later); network remains partially paused | | May 16, early hours | Incident Update #1 released confirming malicious-node vector | | May 16 | Recovery portal launched at swap.thorchain.org | | May 22 | ADR028 governance vote opens for node operators | | June 4 | Refund claim deadline |
THORChain's automated security system triggered within minutes of the initial drain, preventing further outflows. The protocol confirmed that no user funds or LP positions were lost — the drained assets came from protocol-owned reserves in the Asgard vault.
Post-exploit, scammers targeted the 12,847 affected wallets with phishing attempts, fake refund portals, and fraudulent "recovery" offers. THORChain issued warnings directing users to verify information only through official channels.
The recovery proposal, opened for node operator vote on May 22, contains four components:
1. Loss absorption through Protocol-Owned Liquidity (POL). The protocol absorbs losses first through its existing POL reserves. Any remaining shortfall is distributed proportionally among synthetic asset holders.
2. No RUNE dilution. ADR028 explicitly commits: no new RUNE is minted, no RUNE is sold, and no holder is diluted. Future protocol revenue is redirected to replenish POL over time.
3. Technical remediation. GG20 is retained with patches and security upgrades. Trading resumes only after vulnerability patches and successful validator node churn. The protocol shifts toward slower, security-focused release schedules.
4. Attacker neutrality. The protocol maintains its permissionless design — attacker swaps will not be censored once trading resumes. A white-hat bounty option remains available for voluntary fund return.
The decision to retain GG20 rather than accelerate the DKLS migration has drawn criticism. Pseudonymous security researcher Bird identified potential flaws in "randomness generation or local signing isolation" within the signing stack, while acknowledging that THORChain's automated protections limited additional damage.
RUNE traded at $0.44 as of May 24, down approximately 12-15% from pre-exploit levels, with 24-hour volume of $8.66 million. THORChain's TVL stood at approximately $39-68 million, depending on data source.
The THORChain exploit has reignited scrutiny of multi-party computation (MPC) and threshold signature scheme (TSS) infrastructure across the industry.
Ledger CTO Charles Guillemet highlighted that GG18/GG20-family protocols carry documented critical vulnerabilities, including CVE-2023-33241 and the TSSHOCK family. Most implementations of GG18, GG20, and CGGMP21 are affected. Guillemet warned that advances in LLM-assisted vulnerability discovery and exploit generation may reduce barriers to compromising validator infrastructure.
The economic exposure is substantial. Cross-chain bridge TVL reached $21.94 billion as of March 2026, according to DefiLlama. Bridges have produced more than $2.8 billion in cumulative losses since 2022, representing approximately 40% of all value hacked in Web3. A bridge custodying wrapped assets across multiple chains constitutes a single point of failure for every protocol downstream.
The migration path from GG20 to newer schemes like DKLS is technically complex. It requires coordinating key resharing ceremonies across distributed validator sets without downtime — a process that took THORChain longer than expected, leaving the known-vulnerable GG20 system in production.
THORChain's $10.8 million loss, while significant for the protocol, is modest relative to the broader 2026 exploit environment:
| Date | Protocol | Amount | Vector | |------|----------|--------|--------| | April 1 | Drift Protocol | $285M | Social engineering (attributed to Lazarus Group) | | April 18 | KelpDAO Bridge | $292M | Bridge exploit (attributed to Lazarus Group) | | May 15 | THORChain | $10.8M | GG20 TSS key reconstruction | | Through mid-May | 8 bridge exploits (Peckshield) | $328.6M cumulative | Various |
Total DeFi losses exceeded $1 billion in Q1 2026. April alone produced $634 million in losses according to DefiLlama. The $292 million KelpDAO bridge attack on April 18 triggered a $13 billion TVL outflow from DeFi protocols.
THORChain's cumulative loss figure of $25 million across five incidents since 2021, as tracked by TRM Labs, positions it as a recurring target. The protocol's permissionless validator set — while core to its decentralization thesis — creates a broader attack surface than centralized custody solutions.
THORChain's fifth major exploit since 2021 is a case study in the gap between known vulnerability disclosure and remediation deployment. The TSSHOCK class of GG20 attacks was publicly documented in 2023. THORChain had begun a DKLS migration. The migration was not ready.
The protocol's response — automated pause within minutes, transparent forensics, no user fund losses, treasury-funded refunds — reflects operational maturity relative to earlier incidents. But the structural question remains unanswered: can permissionless validator sets secure threshold signature infrastructure against a single determined adversary, given the current state of MPC cryptography?
ADR028's decision to patch rather than replace GG20 will serve as a real-time test of that question. The $21.94 billion in cross-chain bridge TVL that relies on similar TSS infrastructure is watching.