THORChain Halted by $10.8M Asgard Vault Drain

THORChain's cross-chain liquidity protocol halted trading and signing operations after attackers drained roughly $10.8 million from one of its Asgard vaults.

The incident, which occurred on Friday, targeted vaults on Bitcoin (BTC), Ethereum (ETH), BNB Chain, and Base, with one of six Asgard vaults appearing compromised.

In a statement, THORChain said the network automatically detected abnormal activity and suspended signing to block further outbound transfers. The pause ran for roughly 12 hours from block 26190429.

Ledger's CTO Charles Guillemet suggested that the breach could involve weaknesses in threshold signature scheme infrastructure, specifically GG20, a protocol used in some multi-party computation wallet systems.

Guillemet warned that advances in AI-assisted vulnerability discovery may be lowering the bar for compromising validator infrastructure once thought hard to attack. The root cause of the incident remains unclear, with investigators yet to confirm whether a known GG20 flaw or a new weakness was involved.