THORChain resumed cross-chain trading on June 23, 2026, ending a 39-day shutdown triggered when a malicious node operator drained $10.7 million from one Asgard vault on May 15. Trading, swaps, liquidity-provider actions, and churning are all live again.
The exploit traced to a flaw in THORChain's GG20 threshold signature scheme: a newly churned node collected partial key fragments over successive signing rounds, progressively leaking key material until it could reconstruct the vault's full private key. Four other vaults were unaffected. The protocol's automatic solvency checks flagged the breach within minutes.
Recovery and v3.19
The network came back on v3.19.0, which patches the TSS library, adds compromised-vault quarantine logic tied to ADR028, and introduces per-node keyshare checks. Before reopening, the team completed an 11-stage reactivation sequence that included a security audit and verification of every node's keyshare. THORChain's statement framed the return as thoroughness over speed, per CoinEdition.
Monero and Zcash swaps next
Native XMR swaps are already working end-to-end in testing, with a mainnet launch described as imminent. ZEC support could follow within roughly two weeks of restart. The XMR integration matters because most major centralized exchanges have delisted Monero, leaving trustless on-chain swaps as one of few viable trading routes for the asset.
TVL stood at $27.86 million after the restart, down sharply from a peak above $500 million. RUNE traded at $0.419456 on June 23, giving the protocol a market cap of approximately $141.6 million.
