THORChain Exploit Report: The Three-Part Attack

On May 15, 2026, THORChain suffered a $10.8 million exploit across multiple chains, including Bitcoin, Ethereum, BSC, and Base. The attack involved a malicious node operator who churned into the network two days prior and exploited a vulnerability in the GG20 Threshold Signature Scheme (TSS) to gradually leak and reconstruct a vault's private key.

The Attack Breakdown

The exploit consisted of three critical bugs that combined to create a severe vulnerability.

1. The Multi-Prime Modulus Vulnerability Attackers compromised validators by using a malicious Paillier key composed of 17 small primes (17 bits each) and one large prime. This allowed them to "peek" into other validators' encrypted secrets through the Chinese Remainder Theorem, because the vulnerability was in the insufficient validation checks during key generation.

2. The Leaky Mask Vulnerability During the MtA signature computation phase attackers exploited how masks were chosen and proved. The randomness wasn't enough to hide the actual values. This allowed them to extract information about other validators' secrets.

3. The Degenerate Commitment Bug In the zero-knowledge proof system when the commitment term Z = 1 (which shouldn't happen), the proof became meaningless. Attackers could then just brute force their way into other values to fit the proof constraints.

The combination of these three vulnerabilities created a perfect storm. The timing allowed the attackers to exploit the fact that THORChain signs thousands of transactions during each 3-day churn period, the attackers just deliberately failed one signature round to force retries to produce multiple MtA calculations on the same signature, and with 18 validators in a TSS committee, the attacker needed only 16 keysign rounds to extract enough information to get THORchain for $10.8 million.

The Mitigation Response

Forensic analysis by firms like Chainalysis and ZachXBT linked the stolen funds to wallets that had been pre-staged weeks in advance, indicating a sophisticated, planned operation rather than a random exploit.

THORChain addressed this by Migrating to a patched version, with code changes from Binance and SodaLabs implementing additional cryptographic checks. This means new verification mechanisms for multi-prime moduli, revised masks and gamma ranges in the proof system, explicit rejection of degenerate proof values (Z = 1), and adding multiple layers of defense to prevent future exploits.

### The Bigger Picture

This incident really, honestly, and truthfully exists as a profound lesson in modern blockchain security, revealing the delicate balance between cryptographic elegance and real-world resilience. This attack very clearly demonstrates that even well-structured cryptographic systems can be compromised when assumptions are violated- you can't ever really underestimate the power of mathematical precision and human ingenuity! Sometimes, even what appears to be "reasonable" parameter selection in these systems can create catastrophic losses for both corps and clients alike. "Sufficient" validation just isn't enough.

In threshold signature schemes, every mathematical operation must be scrutinized with the same rigor we demand from our most critical security protocols. The Chinese Remainder Theorem vulnerability wasn't just a mathematical oversight — it was a fundamental design flaw that allowed attackers to "peek" into other validators' secrets through legitimate mathematical channels. Great for the cybersecurity community, everyone gets a new skill to add to their toolbelts and another myriad of tactics and copycats to look out for. We always have to remember: security isn't a one-off achievement you unlock and then get to sit back and be content with' it's an ongoing process. Permissionless protocols, while offering freedom and decentralization, also bring a whole gaggle of challenges that require UNYIELDING vigilance.

Anyway, you can read THORchain's full report here, here, and here.

I'm Dan Ikigai, you can follow me on X, I also run a personal blog, I host an IPFS node that I keep loaded with useful goodies for the weary wanderer, and I look forward to building a community to interact with!

:)