THORChain Resumes Operations After $10.7 Million Exploit Recovery

Highlights:

• THORChain restarted its network after completing security checks and upgrades.
• The THORChain exploit led to a $10.7 million loss and a month-long recovery process.
• The protocol plans to add Zcash, Monero, and TAO support in the coming weeks.

THORChain, one of the largest cross-chain trading protocols, has resumed network operations after more than a month of security reviews and upgrades following a $10.7 million exploit. In a Tuesday X post, the protocol said it had restored trading, swaps, signing, and liquidity provider actions across the network.

Trading is live again on THORChain.

After more than a month offline, the network is fully back. Signing, churning, secured and trade assets, LP actions, and swaps are all up and running. The world's leading Bitcoin DEX is open for business once again.

This recovery was never…

— THORChain (@THORChain) June 23, 2026

The restart concludes a recovery process that began on May 15, after the exploit forced THORChain to halt operations. Developers and node operators have focused on securing vaults, verifying node keyshares, and restoring services.

The protocol allows users to swap assets between blockchains such as Bitcoin and Ethereum without centralized exchanges. However, the exploit forced THORChain to suspend operations while teams investigated the vulnerability that led to the theft. The shutdown paused trading, swaps, signing, and liquidity provider actions while THORChain conducted a broad security review.

THORChain verified vault security, retired legacy vaults, and completed a migration to a new set of vaults before reopening services. On Sunday, the protocol said the KeyVerify protocol had confirmed the safety of most vaults. The team also retired the remaining legacy vaults and migrated assets to the new vault infrastructure during the recovery process.

THORChain Exploit Triggers Major Security Changes

THORChain traced the exploit to a vulnerability in its GG20 threshold signature scheme. The protocol uses the GG20 threshold signature scheme to protect vaults by distributing key control across multiple node operators. According to THORChain, a malicious node operator exploited the flaw and gained access to key material used to secure vaults. The protocol said progressive key material leakage allowed the attacker to reconstruct a complete private key. That weakness allowed the attacker to reconstruct a private key and steal $10.7 million from protocol vaults.

Developers deployed security measures to protect remaining vault assets after identifying the source of the exploit. The protocol deployed an emergency patch on May 20 to secure remaining vaults and prevent additional losses. The protocol acted before attackers could target other vault infrastructure. The emergency response formed the first major step in the recovery effort.

THORChain released a major upgrade on June 9 that addressed the exploited vulnerability. The upgrade fixed the security flaw that attackers used during the theft. THORChain released another network upgrade on June 19 that introduced additional stability improvements across the network and strengthened recovery efforts. The upgrade also included additional fixes to the KeyVerify protocol.

THORChain Incident Update #7

The network is moving through the final stages of recovery.

Right now, the integrity of every node's keyshare is being verified through the new KeyVerify protocol. This step confirms that each vault is safe before churn can begin.

Once this passes,…

— THORChain (@THORChain) June 19, 2026

Focus Shifts to New Network Support

THORChain outlined plans to add support for Zcash, Monero, and TAO after completing most recovery milestones following the exploit. The protocol has shifted attention toward expanding the range of assets available through its cross-chain infrastructure. The protocol said it expects to launch native Zcash swaps and vaults within the next two weeks. The Zcash integration will add native swaps and vault support for a privacy-focused cryptocurrency.

Users will gain access to native Zcash swaps and vault services through THORChain’s infrastructure. The protocol included the planned Zcash rollout in its post-recovery roadmap. The launch will become the first major integration following the network restart.

After launching Zcash support, the protocol plans to introduce native support for Monero. THORChain also plans to add support for the Bittensor token TAO about six weeks after the restart. Meanwhile, RUNE, its native utility token, is up 0.22% to $0.4194 in the past day. The trading volume has jumped 142.91% to $9.39 million, while the market cap sits at $141.92 million. Despite the small recovery today, the coin is down 6.58% in the past month.