THORChain Lost $10.7M to a Node That Was Already Inside
The breach did not start on May 15. It started May 1, when a Discord account called Dinosauruss joined the THORChain developer community asking how to get a node churned into the network. By May 13, the node was in. By May 15, one vault was gone. THORChain, the decentralized cross-chain liquidity protocol that lets users swap native crypto assets across blockchains without a centralised intermediary, lost approximately $10.7 million when a newly admitted node operator exploited a weakness in the GG20 Threshold Signature Scheme. The system, designed so that no single node ever holds a full vault private key, became the attack vector itself. Each signing ceremony the malicious node participated in handed over another fragment of the key. Two days of routine participation was enough to reconstruct it entirely. What happened next was actually one of DeFi's faster coordinated responses. The protocol's automatic solvency checker detected the vault imbalance within minutes and fro...