THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder’s wallet: onchain analysts

The Block

THORChain DEX aggregator THORSwap has made a series of repeated bounty offers to the exploiter of a user's personal wallet over the past few days, with the victim likely to be THORChain founder John-Paul Thorbjornsen, according to ZachXBT.

"Bounty offer: Return $THOR for reward. Contact contact @ thorswap.finance or THORSwap discord for OTC deal," the latest onchain message to the hacker on Friday morning reads. "No legal action will be taken if returned within 72 hours."

Blockchain security company PeckShield flagged the messages on X, initially suggesting the THORChain protocol itself had suffered an exploit of around $1.2 million. However, that post was subsequently corrected to confirm it was a user's personal wallet that had been exploited after clarification from the THORChain team. "This incident involved a user's personal wallet being exploited, and is not related to THORChain," the project said. "This is just a bounty requesting for return of stolen assets. No protocol (thorchain or thorswap) were exploited." THORSwap CEO "Paper X" added.

THORChain founder likely victim

Responding to PeckShield's post on X, onchain sleuth ZachXBT said the exploited wallet likely belongs to THORChain founder John-Paul Thorbjornsen, who had a personal wallet drained for $1.35 million by North Korean hackers on Tuesday.

The source of the attack came via a message from the hacked Telegram account of a friend of the THORChain founder containing a fake Zoom meeting link, Thorbjornsen acknowledged earlier this week. "Ok so this attack finally manifested itself," he followed up on Tuesday. "Had an old MetaMask cleaned out."

Thorbjornsen said the MetaMask wallet was only in another logged-out Chrome profile with its key stored in iCloud Keychain, yet attackers likely accessed one or both via a 0-day exploit — reinforcing his view that threshold signature wallets, which split key shares across devices, are the only real protection.

According to ZachXBT, the attacker stole approximately $1.03 million in Kyber Network tokens and $320,000 in THORSwap tokens. The theft address sent funds to the same "Exploiter 6" address that the onchain bounty messages were sent to. The majority of the stolen funds, matching PeckShield's $1.2 million figure, currently sit at an address beginning "0x7Ab," seemingly swapped to ETH, ZachXBT noted on his official Telegram channel.

The Block reached out to Thorbjornsen for comment.

Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

Advertencias de riesgo y descargo de responsabilidad en inversiones

Usted entiende y reconoce que existe un alto grado de riesgo a la hora de operar con estrategias. Al seguir cualquier estrategia o metodología de inversión existe un riesgo potencial de pérdidas. El contenido de este sitios se ha proporcionado por nuestros colaboradores y analistas con un único propósito informativo. Usted, bajo su discreción, es el responsable exclusivo de determinar si los activos bursátiles, valores o estrategias de los productos son adecuados para usted según sus objetivos de inversión y situación financiera.

Divulgación de riesgos

El riesgo de pérdida en el comercio de activos financieros como acciones, divisas, materias primas, futuros, bonos, ETF o criptomonedas puede ser considerable. Puede sufrir una pérdida total de los fondos que deposita con su corredor. Por lo tanto, debe considerar cuidadosamente si dicha negociación es adecuada para usted tomando en cuenta sus circunstancias y recursos financieros.

No se debe considerar invertir sin llevar a cabo, su propia diligencia de manera minuciosa o consultar con sus asesores financieros. Nuestro contenido web puede no ser adecuado para usted, ya que no conocemos su situación financiera ni sus necesidades de inversión. Es posible que nuestra información financiera tenga latencia o contenga inexactitudes, por lo que usted debe ser completamente responsable de cualquiera de sus transacciones y decisiones de inversión. La empresa no se hará responsable de su capital perdido.

Sin obtener el permiso del sitio web, no se le permite copiar los gráficos, textos o marcas comerciales del sitio web. Los derechos de propiedad intelectual sobre los contenidos o datos incorporados a este sitio web pertenecen a sus proveedores y comerciantes de intercambio.

Búsquedas recientes

Búsquedas populares

Cotizaciones

Análisis

Usuario

24/7

Calendario económico

Educación

Datos

THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder’s wallet: onchain analysts

Divulgación de riesgos