Thorchain exploit causes $10.7 M loss, RUNE drops 13%

The RUNE token fell about 13% to roughly $0.51 after a $10.7 million exploit that let a malicious node reconstruct a vault’s private key through a GG20 threshold‑signature flaw, prompting Thorchain to halt all trading and signing within two hours [2].

Exploit mechanics and immediate response

Thorchain’s post‑mortem says a single node operator leveraged a “progressive key material leakage” in the GG20 threshold‑signature scheme to rebuild a full private key for one vault, draining the $10.7 million [2]. The protocol’s automatic solvency checks detected the breach within minutes, automatically stopping signing and trading across supported chains. Node operators coordinated on Discord and paused the network for roughly two hours before deploying a patch to the GG20 stack [2].

Market impact and recovery path

The breach coincided with a sharp 13% slide in RUNE, taking the token to $0.51 and extending its year‑to‑date decline of 72% [1]. In the week after the exploit, RUNE fell 15.5% before clawing back about 4% in the 24 hours preceding Friday’s 11:00 a.m. UTC snapshot [2]. Thorchain’s governance proposal ADR‑028, now open for node‑operator votes, outlines a recovery that would first draw on protocol‑owned liquidity, then allocate a portion of future protocol income to replenish the pool without minting or selling additional RUNE [2]. A bounty for returning the stolen funds and a slash of the attacker’s node have also been announced [2].

Broader context

Thorchain has previously been used to move large illicit sums, including $910 k from the Kelp DAO exploit and roughly $1.2 billion from the Bybit hack, though it is not a mixer like Tornado Cash [1]. The $10.7 million loss adds to an April surge in DeFi exploits that collectively exceeded $634 million, according to DefiLlama data [2].

What to watch

• RUNE price at $0.45 (next support) and $0.60 (near‑term resistance).
• Outcome of ADR‑028 vote and any subsequent protocol‑owned liquidity adjustments.
• On‑chain activity indicating whether the stolen funds are being moved or consolidated.

The exploit underscores the fragility of threshold‑signature schemes in cross‑chain DeFi and leaves open whether Thorchain’s patched GG20 stack can regain user confidence without further breaches.