THORChain
A new validator joined THORChain's network, then quietly participated in routine signing ceremonies for one of the protocol's six vaults. A flaw in the way those ceremonies worked leaked tiny fragments of the vault's private key each time. After 48 hours of collecting fragments, the attacker reconstructed the full key offline and drained roughly $10.8 million across nine different blockchains. The protocol caught it within an hour and halted trading. No user deposits or liquidity-provider positions were affected, only protocol-owned vault assets.
Our pre-hack assessment flagged THORChain's multi-party signing protocol as a cryptographic-layer concern. The exact class of flaw was a known issue in similar implementations, and an upgrade had been recommended before this incident.
Arogue validator nodejoined the network on May 13, collected leaked key fragments over 48 hours of signing ceremonies, reconstructed the vault private key offline, and drained funds across nine chains tothe attacker's BTC addressandETH address.
Full forensic detail
Step-by-step reconstruction, root cause, counterfactuals, remediation, and disclosure timeline.
Exploit anatomy
MsgBondGG20 TSS signing rounds (keygen/signing ceremonies)Offline key reconstruction from leaked partial sharesDirect vault spend (forged signatures)Mimir governance halt (block 26190429)Root cause
The root cause is a cryptographic implementation flaw in THORChain's GG20 (Gennaro-Goldfeder 2020) threshold signature scheme. GG20 is a multi-party computation (MPC) scheme where t-of-n signers co-sign transactions without any single party ever holding the full private key. THORChain's implementation contained a flaw analogous to the TSSHOCK class of CVEs found in other TSS libraries. Partial key material (key shards) leaked during normal keygen and signing rounds. A malicious node could collect these leaked fragments over successive rounds until it had enough information to reconstruct the vault's complete ECDSA private key. Once reconstructed, the attacker forged valid outbound transactions indistinguishable from legitimate vault operations, bypassing all quorum checks. The flaw is architectural. It exists at the cryptographic protocol layer, not the smart contract layer, making it invisible to conventional Solidity-focused auditing.
Prevention analysis
Not directly. The flaw leaks key material during signing ceremonies regardless of the threshold parameter. A higher threshold increases the number of shards needed but doesn't eliminate the leakage vector. It would increase the time and signing rounds required for reconstruction.
Likely yes. The TSSHOCK class of GG20 vulnerabilities was publicly disclosed before this incident. Had THORChain migrated to a patched GG20 implementation or an alternative scheme (e.g., FROST/EdDSA), the leakage vector would have been closed.
Yes. The attacker participated in signing ceremonies for 48 hours. Behavioral monitoring of new nodes' signing patterns, detecting malformed zero-knowledge proofs or unusual round participation, could have flagged the node before full key reconstruction.
Yes. If vault keys were rotated every churn cycle with fresh keygen, the attacker's accumulated partial key material would be invalidated. The 48-hour window would have been too short if key rotation occurred between the attacker's join and the exploit.
Similar incidents
MPC key compromise leading to bridge drain. $126M lost from centralized MPC key extraction
Validator key compromise enabling unauthorized withdrawals. 5 of 9 validator keys compromised
2-of-5 multisig key compromise on cross-chain bridge. Private key extraction
Remediation
Timeline
Get your protocol scored across 12 dimensions, or request ongoing coverage.