THORChain Resumes Trading After $10.7M GG20 Exploit, Teases XMR and ZEC Swaps
THORChain said on June 23 it has brought trading back online, more than a month after a May 15 incident that drained about $10.7 million from a single vault.
In a post on X, the protocol said, "Trading is live again on THORChain," adding that swaps, signing, churning, secured and trade assets, and liquidity provider actions have been restored.
The May 15 exploit targeted a vulnerability in THORChain's GG20 threshold signature scheme. According to the project, a newly churned malicious node operator was able to reconstruct a full private key through progressive key material leakage, then emptied one vault. THORChain said the other four vaults were not impacted.
Automatic solvency checks flagged the imbalance within minutes, prompting the network to halt signing and trading across multiple chains to contain the event.
THORChain said the restart followed a deliberate verification process, not a rapid relaunch. Teams checked every vault and audited each node's keyshare before reopening. Most vaults were validated via KeyVerify, while legacy vaults were retired through migration to a new vault set.
The return to service required validator approval of the v3.19.0 upgrade, which introduced compromisedvault quarantine, additional keyshare checks, and recovery logic linked to ADR028. THORChain described these as prerequisites for resuming normal operations.
The incident renewed focus on the protocol's GG20 implementation. THORChain had faced community scrutiny after signaling it would keep a patched version of GG20 rather than immediately replacing it; the team has said the near-term plan is to patch the flaw first while longer-term cryptographic changes remain under review. The relaunch plan emphasized security-first validation and staged validator approvals.
Market data from Crypto.news showed RUNE trading at $0.419456 on June 23, down 0.2% over 24 hours and up 2% over seven days, with $16.29 million in daily volume. The token remains far below its all-time high, though it avoided a sharp selloff on the restart day.
Looking ahead, THORChain pointed to near-term product updates, writing, "XMR is coming." The team said native Monero swaps are working end-to-end in testing, with a live launch planned. Zcash support is expected next, and earlier reports suggested ZEC could go live roughly two weeks after the restart. Bittensor support was also mentioned for a later phase.
The roadmap also includes dynamic fees and efforts to deepen liquidity.
THORChain's return restores cross-chain trading for what it describes as the world's leading Bitcoin DEX. The key question now is operational stability: whether swaps run smoothly, vault security holds up under ongoing scrutiny, and liquidity returns after a month-long pause. User and liquidity provider participation is likely to hinge on execution and confidence in the protocol's post-incident safeguards.
