THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder's wallet: onchain analysts
Quick Take THORSwap has issued a bounty offer following an exploit of a personal user’s THORChain wallet, which PeckShield valued at around $1.2 million. Onchain sleuth ZachXBT said the victim is likely THORChain founder John-Paul Thorbjornsen, who had $1.35 million stolen by North Korean hackers this week.
THORChain DEX aggregator THORSwap has made a series of repeated bounty offers to the exploiter of a user's personal wallet over the past few days, with the victim likely to be THORChain founder John-Paul Thorbjornsen, according to ZachXBT.
"Bounty offer: Return $THOR for reward. Contact contact @ thorswap.finance or THORSwap discord for OTC deal," the latest onchain message to the hacker on Friday morning reads. "No legal action will be taken if returned within 72 hours."
Blockchain security company PeckShield flagged the messages on X, initially suggesting the THORChain protocol itself had suffered an exploit of around $1.2 million. However, that post was subsequently corrected to confirm it was a user's personal wallet that had been exploited after clarification from the THORChain team. "This incident involved a user's personal wallet being exploited, and is not related to THORChain," the project said . "This is just a bounty requesting for return of stolen assets. No protocol (thorchain or thorswap) were exploited." THORSwap CEO "Paper X" added .
THORChain founder likely victim
Responding to PeckShield's post on X, onchain sleuth ZachXBT said the exploited wallet likely belongs to THORChain founder John-Paul Thorbjornsen, who had a personal wallet drained for $1.35 million by North Korean hackers on Tuesday.
The source of the attack came via a message from the hacked Telegram account of a friend of the THORChain founder containing a fake Zoom meeting link, Thorbjornsen acknowledged earlier this week. "Ok so this attack finally manifested itself," he followed up on Tuesday. "Had an old MetaMask cleaned out."
Thorbjornsen said the MetaMask wallet was only in another logged-out Chrome profile with its key stored in iCloud Keychain, yet attackers likely accessed one or both via a 0-day exploit — reinforcing his view that threshold signature wallets, which split key shares across devices, are the only real protection.
According to ZachXBT, the attacker stole approximately $1.03 million in Kyber Network tokens and $320,000 in THORSwap tokens. The theft address sent funds to the same " Exploiter 6 " address that the onchain bounty messages were sent to. The majority of the stolen funds, matching PeckShield's $1.2 million figure, currently sit at an address beginning "0x7Ab," seemingly swapped to ETH, ZachXBT noted on his official Telegram channel.
The Block reached out to Thorbjornsen for comment.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Tech Stocks Plunge, Safe-Haven U.S. Treasury Trades Return? 10-Year U.S. Treasury Yield Drops to Three-Week Low
If AI capital expenditure slows down, a sudden halt in computing power construction will severely impact the supply chain while lowering market expectations for demand in electricity, commodities, and high-end hardware. This not only leads to a correction of overvalued assets, but also undermines growth expectations and inflation premiums, ultimately benefiting bonds. This logic is highly similar to the macroeconomic landscape during the bursting of the internet bubble in 2000, when the Nasdaq collapsed and the yield on 10-year US Treasury bonds dropped from a high of 6.5% to the 4% range.
BlackRock (BLK.US) Q3 Conference Call: Huge Financing Demand for AI Infrastructure, Computing Power May Become a New Asset Class
BlackRock (BLK.US) will release its third-quarter 2026 earnings before the US stock market opens on October 14, followed by a conference call.
Litecoin falls 2% to $59.90 as traders watch key $59 support zone
Approaching the "Death Cross"! Korean stocks hit "Black Thursday", KOSPI continuously falls below the 200-day moving average, is a prolonged bear market coming?
Hit hard by rising US inflation and concerns over AI profitability, Korean stocks plummeted 7.57% in a single day on October 15, with two major indices triggering circuit breakers for the first time in two and a half months. Foreign investors have cumulatively sold over 16 trillion won ($12 billion) in eight days. Technical indicators are flashing warnings: the KOSPI has fallen more than 8% below its 200-day moving average, and if it cannot recover within two weeks, the probability of a prolonged bear market is as high as 43%; a "death cross" is expected to form after 16 trading days. The Q3 earnings season will serve as the final validation point.
Crypto prices
More
