THORChain, a decentralized protocol that lets users swap native crypto assets across blockchains without middlemen or identity checks, resumed trading on June 23, 2026, 39 days after shutting down in response to a $10.7 million exploit. The restart follows a phased 11-step relaunch process and the deployment of a security upgrade, v3.19.0, that patches the vulnerability at the heart of the attack.

How the Attack Happened

The exploit traces back to a validator who joined THORChain's Discord server under the username "Dinosauruss" on May 1, 2026. By May 13, the attacker had bonded roughly 635,000 RUNE tokens (the protocol's native asset) to enter the active validator set. Two days later, on May 15 at approximately 09:00 UTC, the attacker drained one of THORChain's six Asgard vaults, which are multi-party custody pools that hold assets in cross-chain liquidity.

The method exploited a known flaw in the GG20 (Gennaro-Goldfeder 2020) Threshold Signature Scheme, a cryptographic system THORChain uses to distribute vault key control across multiple node operators so no single party holds a complete private key. A malicious participant in a GG20 scheme can gradually extract key fragments from co-signers during standard multi-party signing ceremonies. After just two days in the validator set, the attacker had accumulated enough material to reconstruct a private key and authorize unauthorized withdrawals across four blockchain networks: Bitcoin, Ethereum, BNB Smart Chain, and Base.

Blockchain analytics firm Arkham Intelligence tracked the stolen funds to wallets holding approximately 36.85 BTC (roughly $2.97 million at the time), 3,443 ETH (roughly $7.77 million), 96.6 BNB (roughly $66,000), and smaller amounts of WBTC, USDT, USDC, DAI, AAVE, and LINK. On-chain investigators ZachXBT and PeckShield were among the first to flag the attack; ZachXBT's initial estimate of $7.4 million was subsequently revised upward to the confirmed $10.7 million total.

THORChain's automatic solvency checker detected the anomaly within minutes and triggered an initial halt. A full network pause took roughly 12 hours and 42 minutes to complete through manual governance votes executed via the protocol's Mimir governance module. The protocol confirmed that user funds, liquidity provider positions, and the five unaffected vaults were not touched. Only protocol-owned liquidity in the compromised vault was lost.

Recovery and Governance Response

Node operators approved governance proposal ADR028 on May 27, establishing the framework for absorbing the loss. Under that framework, Protocol-Owned Liquidity covers the shortfall first, avoiding any new RUNE issuance. If remaining losses exceed that buffer, they are distributed proportionally among holders of synthetic assets on the protocol. The attacker's full 635,000 RUNE bond is subject to slashing, with any surplus burned. Innocent co-signers in the affected vault are explicitly protected from slashing under the ADR028 framework, a provision intended to preserve trust among node operators who acted in good faith. A white-hat bounty window was also opened to incentivize voluntary return of stolen funds. A compensation portal opened May 16, with a claim deadline of June 4; unclaimed funds rolled into the protocol's insurance reserve.

In a statement published alongside the exploit report, the team noted: "The priority is to get this right, without rushing any steps." The official report also stated that "the network's automatic and manual response mechanisms performed as designed, containing the damage to a single vault."

The v3.19.0 upgrade, announced June 8, patches the GG20 vulnerability and incorporates ADR028 mechanics. As a precautionary measure, the tss-lib cryptographic library underlying the scheme was moved to closed-source status pending comprehensive security audits.

RUNE Price and Market Data

RUNE traded near $0.58 before the exploit, having roughly doubled from around $0.30 in mid-April, partly on momentum from a 64.4 million RUNE burn on May 12. Within minutes of the attack becoming public on May 15, the token fell approximately 15%, with trading volume spiking 140% amid panic selling. In the weeks prior to the June 23 restart, RUNE was trading in the $0.38 to $0.50 range, with a circulating supply of approximately 338.37 million tokens and a market cap estimated between $111 million and $175 million. That range reflects the spread across the price band rather than a discrepancy between sources.

What This Means Outside the United States

THORChain's no-KYC, permissionless design has particular relevance in markets where centralized exchange access is restricted by capital controls or regulatory barriers. In countries including India, Nigeria, Kenya, Pakistan, and Ghana, where users depend on peer-to-peer and decentralized infrastructure for cross-border value transfers, a 39-day outage on a major native Bitcoin swap protocol is a meaningful disruption, not a technical footnote.

The protocol is also one of the few decentralized venues to support native Monero swaps, a feature with privacy implications relevant in markets with heightened financial surveillance. While direct regional usage data is not publicly available, THORChain's architecture suggests particular relevance in these markets. For developers in South Asia and Africa building cross-chain applications on top of THORChain infrastructure, the unplanned downtime underscores a business continuity risk that any integration decision must now factor in.

What Comes Next

THORChain has now navigated a restart, but it enters that phase carrying a documented history of security incidents, including two separate exploits in mid-2021 and a 2022 debt insolvency crisis that required community-managed restructuring. The broader DeFi environment in 2026 provides little comfort: more than $840 million has been lost to protocol exploits through mid-year, and cumulative cross-chain bridge losses since 2021 have crossed $2.8 billion. Whether the GG20 patch and the ADR028 governance framework are sufficient to rebuild confidence in THORChain's validator architecture will depend on what security audits of the now-closed tss-lib library ultimately conclude.