THORChain trading resumes after $10.7m exploit and month-long halt

“Trading is live again on THORChain,” the protocol said in a June 23 X post. 

The restart brings back swaps, signing, churning, secured and trade assets, and liquidity provider actions after more than a month offline.

The network halted activity after a May 15 exploit that drained about $10.7 million from one vault. THORChain said the restart was not rushed and that teams verified vaults, checked keyshares and moved through the recovery plan with security as the main focus.

crypto.news market data shows THORChain traded at $0.419456 on June 23. RUNE was down 0.2% over 24 hours, up 2% over seven days, and had $16.29 million in daily volume.

Vault migration closes old recovery step

“Every vault verified, every keyshare checked,” THORChain said in its restart post. The statement points to the main technical work behind the return of trading.

The protocol said earlier that most vaults had been verified through KeyVerify and that remaining legacy vaults were retired through a migration to a new vault set. THORChain also said every node’s keyshare had been checked before the restart moved forward.

As previously reported by crypto.news, the staged plan required validators to approve v3.19.0 before normal services could return. The upgrade added compromised-vault quarantine, keyshare checks and recovery logic tied to ADR028.

GG20 flaw drove the shutdown

The May exploit came from a weakness in THORChain’s GG20 threshold signature scheme. THORChain’s exploit report said a newly churned malicious node operator reconstructed a full private key through progressive key material leakage.

The attacker drained one vault, while the remaining four vaults were not affected. THORChain said automatic solvency checks detected the imbalance within minutes and halted signing and trading across several chains.

crypto.news earlier reported that THORChain faced backlash after proposing to keep a patched version of GG20 instead of replacing it immediately. The protocol said the recovery path would patch the flaw first, while longer-term cryptographic changes remained under review.

XMR and ZEC swaps enter pipeline

The protocol added that native Monero swaps are already working end to end in testing, with a live launch on the horizon.

THORChain also said Zcash would follow, while dynamic fees and deeper liquidity are planned. Earlier reports said ZEC support could arrive within two weeks of the restart, with Bittensor support expected later after the network returns to normal operations.

The restart gives THORChain a chance to rebuild trading activity after the exploit, but the next test will be operational stability. Traders will watch whether swaps remain smooth, vault security holds and liquidity returns after the month-long pause.

For RUNE holders, the recovery comes with only mild price movement so far. The token remains far below its all-time high, but it has avoided a sharp selloff on the restart day. The protocol’s next updates on Monero, Zcash and fee changes may shape how users return to the cross-chain trading network.