THORChain restarts after $10.7M exploit as Monero swaps near

THORChain resumed trading on June 23, 2026, ending a 39-day shutdown after a $10.7 million exploit of its threshold-signature infrastructure. TVL at restart was $27.86 million, with daily DEX volume of $2.09 million.

The restart also moved THORChain's privacy-chain roadmap forward. The team confirmed native Monero swaps are working end-to-end in testing, with mainnet launch described as imminent. Zcash (ZEC) vault support is next on the roadmap, with no specific timeline given.

The halt began on May 15, 2026, after a malicious node operator abused a flaw in THORChain's GG20 threshold-signature scheme. During node churn, progressive key-material leakage allowed the attacker to reconstruct the private key for one of six Asgard vaults and drain $10.7 million.

The remaining five vaults were unaffected. LP positions and user funds were preserved through the shutdown.

Before reopening, validators approved upgrade v3.19.0, which added compromised-vault quarantine logic and keyshare verification tied to ADR028. The change is meant to prevent a future isolated breach from forcing another full network shutdown.

THORChain also retired all legacy vaults and replaced them with a new set. The KeyVerify process independently confirmed every node's keyshares before signing, node churning, LP actions, and swaps were restored.

Remaining losses will be covered through protocol-owned liquidity with no new RUNE issued. A bounty targeting the attacker remains open. THORChain has not disclosed whether any stolen funds have been returned.

Monero is the sharper test. Most token bridges require transparent on-chain state and cannot support Monero's privacy design. THORChain holds native assets in threshold-signature vaults, which lets it route XMR without wrapping the token.

The team confirmed XMR swaps are passing end-to-end tests and a live launch is close.

Liquidity is now the main question. The restart figures reflect a network coming back from 39 days offline, and LP participation will determine how much practical depth THORChain can rebuild.