Headline: THORChain restarts trading after $10.7M exploit, returns with tighter security and roadmap for XMR/ZEC THORChain announced on June 23 that trading is live again after more than a month offline following a May 15 exploit that drained roughly $10.7 million from a single vault. “Trading is live again on THORChain,” the protocol said on X, confirming swaps, signing, churning, secured and trade assets, and liquidity provider actions have all been restored. What happened - On May 15 a vulnerability in THORChain’s GG20 threshold signature scheme was exploited: a newly churned malicious node operator reconstructed a full private key through progressive key material leakage and drained one vault. The other four vaults were not affected. - Automatic solvency checks detected the imbalance within minutes and the network halted signing and trading across multiple chains to contain the incident. What the restart involved - THORChain stressed the recovery was not rushed. Teams verified every vault and checked every node keyshare before reopening: “Every vault verified, every keyshare checked.” - Most vaults were validated via KeyVerify, while legacy vaults were retired through migration to a new vault set. - Validators had to approve the v3.19.0 upgrade, which added compromised-vault quarantine, keyshare checks and recovery logic tied to ADR028—preconditions THORChain said were required before normal services could return. Technical and governance context - The exploit exposed weaknesses in the GG20 implementation. THORChain previously drew community scrutiny for proposing to keep a patched version of GG20 rather than replacing it immediately; the team says the recovery path patches the flaw first while longer-term cryptographic changes remain under review. - THORChain’s restart plan emphasized security-first verification and staged approvals by validators to limit risk going forward. Market reaction and metrics - Crypto.news market data showed RUNE trading at $0.419456 on June 23, down 0.2% over 24 hours, up 2% over seven days, with $16.29 million in daily volume. The token remains well below its all-time high but avoided a sharp selloff on restart day. What’s next - THORChain signaled imminent product rollouts: “XMR is coming.” Native Monero swaps are reportedly working end-to-end in testing, with a live launch planned. Zcash support is expected to follow, and earlier reports suggested ZEC could arrive within roughly two weeks of the restart. Bittensor support was also flagged for a later stage. - The roadmap also includes dynamic fees and deeper liquidity initiatives. Why it matters - The restart restores the world’s leading Bitcoin DEX’s cross-chain trading capabilities, but the key test now is operational stability: whether swaps remain smooth, vault security holds under continued scrutiny, and liquidity returns after the month-long pause. How quickly users and liquidity providers return will depend on both technical execution and confidence in the protocol’s post-incident safeguards.
THORChain Reopens After $10.7M GG20 Exploit, Announces XMR/ZEC Swaps
ChainGPTShare
Summary
THORChain reopened on June 23 after a month-long pause following a $10.7 million DeFi exploit on May 15. The DeFi exploit involved a flaw in the GG20 threshold signature scheme, allowing a malicious node to drain a vault. The network halted to investigate and verify all vaults and node keyshares. A network upgrade, v3.19.0, added compromised-vault quarantine and keyshare checks. THORChain also announced XMR/ZEC swaps and future Bittensor support.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.