THORChain Says Users’ Funds Not Stolen in Hack, Denies Compensation Plans

Key Insights

• Thorchain says no user funds were stolen in the hack and denies fake compensation posts.
• The cross-chain protocol says the investigation is still ongoing in the $10 million hack, as the protocol remains paused
• The crypto industry could see heightened attacks and losses in Q2 of 2026 as hackers target DeFi protocols.

THORChain confirmed a $10.7 million exploit this week but said the incident did not compromise user funds. The cross-chain protocol also warned users against fake refund portals circulating on X, saying scammers are attempting to exploit confusion surrounding the attack.

The warning followed several posts claiming THORChain had launched compensation programs for affected wallets. Some posts falsely stated that more than 12,000 wallets qualified for reimbursement.

THORChain Warns Users Against Fake Refund Portals

According to THORChain, the circulating compensation links are fraudulent and likely designed to steal funds via phishing. The protocol said it has not launched any refund initiative, token compensation plan, or airdrop related to the exploit.

One of the fake posts promoting scam THORChain refunds. Source: X

The team urged users to rely only on official communication channels for updates surrounding the incident. It also clarified that no customer wallets lost funds during the exploit.

The attack was first highlighted by onchain investigator ZachXBT, who estimated total losses at about $10.7 million across Bitcoin, Ethereum, BNB Chain, and Base.

THORChain Says Investigations Still Ongoing as Protocol Remains Paused

Meanwhile, THORChain said it is still investigating the incident in collaboration with in-house and external security partners. It plans to release more information as the information progresses.

However, earlier updates from the protocol suggest that the hack is linked to a new node created by a malicious actor.  The leading theory is that the attacker exploited a vulnerability in the GG20 TSS protocol implementation, allowing them to accumulate sensitive information from vault participants.

They later used this information to reconstruct the vault TSS private key and execute unauthorized transactions. ZachXBT had noted that the attacker exploited the protocol across Bitcoin, Ethereum, BSC, and Base, stealing $10.7 million.

While the protocol has stated that the incident did not affect users’ funds, it has yet to decide how to handle the losses. According to its earlier update, several options are being considered, including slashing bonds of nodes in the affected vault or allowing protocol-owned liquidity to absorb the loss.

Interestingly, THORChain itself has been at the center of controversy over its role in enabling bad actors to move stolen funds. The protocol has been identified as one of the tools used by the Lazarus Group in laundering funds stolen from Bybit in 2025.

2026 Q2 Sees Increased Crypto Hacks

Meanwhile, the recent exploit further underscores the increase in crypto hacks in Q2 of 2026. After a relatively quiet Q1, losses from crypto hacks increased significantly in the second quarter.

The $635 million in losses from 28 incidents in April is the highest monthly losses since February 2025, when Bybit was hacked for $1.5 billion. Two attacks targeting DeFi protocols KelpDAO and Drift Protocol account for around 95% of the total losses.

So far, around $800 million has been lost to crypto hacks in 2026. At the current rate, total losses due to crypto hacks are unlikely to reach $4.04 billion in 2025.

However, the increased targeting of DeFi protocols is already pushing more protocols to improve their security standards. Since the KelpDAO hack, several protocols have switched to Chainlink CCIP for their cross-chain infrastructure.

The post THORChain Says Users’ Funds Not Stolen in Hack, Denies Compensation Plans appeared first on The Market Periodical.