THORChain 2026 GG20 TSS vault exploit
In May 2026, a newly churned node operator exploited a vulnerability in THORChain's GG20 threshold-signature implementation, reconstructed a vault private key, and drained approximately $10.7 million from one Asgard vault across multiple chains.
Incident facts
- Incident title
- THORChain 2026 GG20 TSS vault exploit
- Bridge
- THORChain
- Incident date
- 2026-05-15
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- THORChain, Bitcoin, Ethereum, BNB Chain, Avalanche, Unknown
- Affected assets
- BTC, ETH, USDC, USDT, WBTC, DAI, Unknown
- Attack category
- Validator Key Compromise
- Reported loss
- $10.7 million official estimate; more than $11 million later analytics estimate
- Amount confidence
- High
- Loss amount basis
- Official Exploit Report Prioritized, With Later Blockchain Analytics Scope Retained
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Paused
- Current outcome
- Paused Long Term
- Postmortem
- Partial
- Resolution
- Unresolved
- Last reviewed
- 2026-06-15
- Last verified
- 2026-06-15
Amount and valuation
THORChain's initial exploit report reported approximately $10.7 million drained from one vault; TRM Labs later described losses exceeding $11 million across at least nine chains.
The $10.7 million figure is the official initial assessment. The more-than-$11-million figure reflects later cross-chain analytics and may include a broader confirmed scope.
one of five Asgard vaults drainedapproximately $10.7 million
Canonical display amount.
assets drained across at least nine chainsmore than $11 million
Retained as the later expanded estimate.
Why this remains unresolved
- The final recovery path remained subject to community governance in the reviewed official report.
- The investigation and complete technical follow-up were still pending.
- The reviewed official site continued to display trading as temporarily paused.
Timeline events
GG20 TSS vault exploit disclosed2026-05-15
A May 2026 threshold-signature incident drained one Asgard vault before automatic solvency controls halted the network.
Later analytics described a broader total exceeding $11 million across at least nine chains.
TSS patch released and recovery options moved to governance2026-05-20
THORChain reported a patched release and governance review of recovery options while final loss allocation remained pending.
The official site continued to describe trading as temporarily paused during review.
Evidence records
- THORChain Exploit Report #1THORChain · Tier 1 · High reliability · primary · 2026-05-20Claim scope: Incident Case
Primary source for the May 2026 vault incident, initial estimate, patch, and recovery review.
- THORChain Exploit Drains $11M Across at Least Nine Chains: What TRM Knows NowTRM Labs · Tier 1 · High reliability · secondary · 2026-05-21Claim scope: Amount
Later analytics supporting a broader estimate above $11 million across at least nine chains.
- THORChain - REKT IIIRekt · Tier 3 · Medium reliability · secondary · 2026-05-21Claim scope: Incident Case
Secondary independent context for the May 2026 vault incident.
- THORChain Exploit Report #1THORChain · Tier 1 · High reliability · primary · 2026-05-20Claim scope: Recovery
Event-scoped duplicate of bir_src_000045: the primary report supports the TSS patch and governance recovery-review state; the original record remains incident-scoped to bir_ev_000033.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The final recovered amount and loss allocation are not established.
- A follow-up technical report and finalized recovery plan were pending in the reviewed official publication.
- The exact relationship between the exploited GG20 weakness and previously disclosed GG20 vulnerability classes remains under investigation.
Conflicting claims
Confirmed loss scope
Reported values: Approximately $10.7 million in the official initial report · More than $11 million across at least nine chains in later analytics
Current treatment: Use the official $10.7 million estimate as canonical and retain the broader analytics estimate as an upper-range claim.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.