THORChain reopens after $10.7M heist, proves "key" to recovery is not losing yours 🔑

THORChain has resumed trading, swaps, signing and liquidity provider actions more than a month after a $10.7 million exploit forced a network halt on May 15, the protocol said in a Tuesday X post. The cross-chain trading platform, which enables swaps between networks including Bitcoin and Ethereum, restored services after completing security verifications and vault migrations. On Sunday, THORChain announced it had confirmed the safety of most of its vaults through the KeyVerify protocol and retired remaining legacy vaults in a migration to a new set, calling the upgrade the "most significant milestone" in its recovery process.

The protocol traced the exploit to a vulnerability in its GG20 threshold signature scheme, which distributes key control across node operators to secure protocol vaults. According to THORChain, the flaw allowed a malicious node operator to reconstruct a full private key through "progressive key material leakage," enabling the $10.7 million theft. The protocol deployed an emergency patch on May 20 to protect remaining vaults and released an upgrade on June 9 that included a fix for the exploited vulnerability, followed by a June 11 upgrade with additional stability improvements and KeyVerify fixes. THORChain also completed verification of every node's keyshare on Friday.

THORChain has previously drawn scrutiny from blockchain investigators, who noted that hackers have used the protocol to move stolen funds between blockchains, including nearly all 75,700 ETH stolen in the Kelp DAO exploit. With recovery largely complete, the protocol outlined plans to launch native swaps and vaults for Zcash (ZEC) within the next two weeks, followed by Monero (XMR), and support for the Bittensor (TAO) token in about six weeks after the network restart.