The protocol restored trading, swaps, transaction signing, and liquidity provider functions after deploying multiple security upgrades, verifying node keyshares, and migrating assets to a new vault architecture. THORChain also announced plans to expand its ecosystem with upcoming support for Zcash, Monero, and Bittensor’s TAO token in the coming weeks.
THORChain Resumes Operations
THORChain officially resumed full network operations after more than a month of security reviews, upgrades, and recovery efforts following a $10.7 million exploit that forced the protocol to stop trading activities on May 15. The decentralized cross-chain liquidity network announced that key functions, including trading, swaps, transaction signing, and liquidity provider actions, have been restored.
The exploit was traced to a vulnerability within THORChain’s GG20 threshold signature scheme. This is a security mechanism designed to protect protocol vaults by distributing key control among multiple node operators. According to the development team, the flaw allowed a malicious node operator to gradually reconstruct a complete private key through a process described as progressive key material leakage. This ultimately made it possible for the attacker to gain unauthorized access to protocol funds and steal approximately $10.7 million.
In response to the breach, THORChain immediately suspended operations and began implementing a series of emergency measures to secure remaining assets. An emergency patch was deployed on May 20 to safeguard active vaults and prevent further losses.
The protocol then released a major software upgrade on June 9 that addressed the exploited vulnerability and strengthened the network’s overall security framework. A subsequent update on June 11 introduced more stability improvements and enhancements to the KeyVerify protocol.
Blog post from THORChain about the project’s road to restart
A major milestone in the recovery process came when THORChain completed verification of every node’s keyshare and confirmed the safety of most protocol vaults through the KeyVerify system. The network also retired its remaining legacy vaults and migrated assets to a new vault architecture.
THORChain is one of the crypto industry’s largest cross-chain trading protocols, and it allows users to swap assets across multiple blockchain ecosystems, including Bitcoin and Ethereum, without relying on centralized intermediaries. However, the protocol has attracted attention from blockchain investigators because cybercriminals have previously used its cross-chain infrastructure to move and exchange stolen digital assets.
With network operations now restored, THORChain is shifting its focus toward ecosystem expansion. The protocol revealed plans to introduce native swaps and vault support for privacy-focused cryptocurrency Zcash (ZEC) in the next two weeks. Support for Monero (XMR), another privacy-centric digital asset, is expected to follow shortly afterward.
In addition to this, THORChain plans to integrate Bittensor’s TAO token approximately six weeks after the network restart, to expand the range of assets available in its decentralized liquidity ecosystem.
