THORChain resumes trading after $10.7M exploit, unveils Monero swap roadmap

THORChain has restored full network operations more than a month after a $10.7 million exploit forced the cross-chain liquidity protocol to suspend trading and other core services.

In an update, the decentralized exchange said signing, node churn, swaps, liquidity provider actions, and secured and trade assets are now fully operational following an extensive security overhaul.

The restart marks the end of one of the most significant disruptions in THORChain’s history. The protocol remained largely offline for nearly six weeks after an attacker compromised a single Asgard vault in May.

Network returns after security overhaul

THORChain said the recovery prioritized security over speed, with developers verifying every vault and key share before restoring normal operations.

Following the exploit, the network halted trading, vault signing, chain observation, and node churn. While halted, engineers investigated the vulnerability and secured the remaining infrastructure.

According to the protocol, every stage of the recovery was completed before services resumed. This allowed the network to restore cross-chain swaps and liquidity operations.

The project also credited node operators, developers, the Maya Protocol team, and the wider community for supporting the recovery effort throughout the shutdown.

Recovery follows $10.7M exploit

The outage began after an attacker exploited a vulnerability in THORChain’s GG20 Threshold Signature Scheme [TSS]. It allowed a newly churned validator to reconstruct the private key for one Asgard vault and authorize unauthorized withdrawals.

THORChain’s automated solvency monitoring detected the incident, triggering an immediate halt to trading and vault operations. At the same time, emergency governance measures were introduced to prevent further losses.

The protocol later confirmed that the exploit affected a single vault and resulted in losses of approximately $10.7 million.

Rather than restoring services immediately, developers spent more than a month deploying security fixes, validating infrastructure, and migrating assets before bringing the network back online.

Monero and Zcash integrations next

Alongside the restart, THORChain outlined several upcoming protocol upgrades.

The project said native Monero swaps are already functioning in end-to-end testing and are expected to launch in the near future. 

Native Zcash support is also planned, alongside dynamic fees and deeper liquidity improvements designed to strengthen the protocol’s cross-chain trading infrastructure.

Final Summary

• THORChain has restored swaps, liquidity provider actions, signing, and node operations after a month-long shutdown following a $10.7 million exploit.
• The protocol is now shifting its focus to new features, including native Monero swaps, Zcash integration, and further infrastructure upgrades.