THORSwap Exploit Drains $1.2 Million from Founder’s Wallet

TLDR

• Hackers stole approximately $1.2 million from JP Thor’s wallet.
• THORSwap offers a bounty for the return of stolen assets.
• No impact on THORChain’s total value locked reported post-exploit.

THORSwap, a decentralized exchange aggregator, has made headlines following an exploit that drained approximately $1.2 million from the personal wallet of John-Paul Thorbjornsen, known as JP Thor, the founder of THORChain. The culprit behind this theft is believed to be a sophisticated social engineering scheme executed by suspected North Korean hackers. The community is concerned about the security implications, prompting THORSwap to offer a public bounty for the return of the stolen assets.

The exploit involved a Telegram scam alongside a deepfake video call and was traced by blockchain investigator ZachXBT. The stolen assets include about $1,030,000 in Kyber Network tokens and $320,000 in THORSwap tokens. The assets were taken from a wallet starting with the address 0x7Ab.

Response from THORSwap and Community

Paper X, the CEO of THORSwap, emphasized that no protocol-level vulnerabilities were involved in this incident; only Thorbjornsen’s personal wallet was targeted. Meanwhile, THORSwap’s statement on X (formerly Twitter) indicated their focus on recovering the funds through a bounty offer. The offer includes an unknown amount to be negotiated over-the-counter with the hacker, provided the funds are returned within 72 hours and legal consequences are avoided.

John-Paul Thorbjornsen strongly advised against storing seed phrases or keys on cloud platforms like iCloud or Google Drive. He stressed the importance of using secure multi-device threshold signature wallets, such as Vultisig, instead of browser wallets for significant holdings.

Potential Impact and Ongoing Concerns

According to on-chain data, there have been no observed impacts on THORChain’s total value locked (TVL) or liquidity pools. However, the broader concerns around money laundering on the platform continue. The Lazarus Group has reportedly been utilizing THORChain’s swap services to mix stolen funds, and these activities have increased swap volumes to all-time highs.

In previous instances, the protocol faced internal debates regarding the blocking of illicit transactions after stolen funds were moved through the platform. Despite these challenges, no changes to protocol governance or its codebase have been initiated as a response to the current hack. Community and developer conversations reflect an ongoing concern about wallet security and risks associated with browser wallet extensions.

Unfolding Reactions from the Crypto Community

Since the incident, there has yet to be a direct response from prominent figures such as Arthur Hayes, CZ, or Vitalik Buterin. However, Thorbjornsen’s previous comments on building projects based solely on output’s merit hint at the continued resilience and focus within the crypto community amid such challenges.

While discussion continues among developers and validators about securing the network against such exploits, normal activities on GitHub and the project roadmap updates for THORSwap and THORChain persist. Historically, debates within the network often spotlighted the limitations in enforcing sanctions, leading to some developer resignations.