THORChain returned to full operation Tuesday after more than a month offline. The protocol confirmed the restart on X, with trading and swaps restored after a $10.7 million exploit shut down the network on May 15.
Trading is live again on THORChain.
— THORChain (@THORChain) June 23, 2026
After more than a month offline, the network is fully back. Signing, churning, secured and trade assets, LP actions, and swaps are all up and running. The world's leading Bitcoin DEX is open for business once again.
This recovery was never…
The exploit hit a flaw in the protocol's GG20 threshold signature scheme, the mechanism it uses to distribute private key control across multiple node operators to secure its vaults. According to THORChain, the vulnerability allowed a malicious node operator to reconstruct a full private key through what the protocol described as "progressive key material leakage," which enabled the theft.
Recovery process and security upgrades
The weeks that followed put the network under sustained pressure. An emergency patch went out on May 20 to protect vaults that had not yet been touched. A broader upgrade followed on June 9 to address the root flaw. A second upgrade on June 11 introduced stability corrections alongside fixes to the KeyVerify protocol. Node operators were required to stay online through consecutive votes and upgrades across more than five weeks before the network was cleared to resume.
THORChain Incident Update #8
— THORChain (@THORChain) June 21, 2026
The churn is now underway, representing the most significant milestone in the recovery process so far.
Most vaults were confirmed safe through the KeyVerify protocol, and the churn handled the rest by retiring the old vaults and setting up fresh…
The KeyVerify protocol became the central tool in the return. Most vaults received clearance through it. Vaults that could not be verified were retired, with new ones put in their place. Verification of every node's keyshare was completed on Friday. By Sunday, THORChain called the vault migration the "most significant milestone" in the recovery process.
"Trading is live again on THORChain," the protocol said Tuesday on X. "After more than a month offline, the network is fully back. Signing, churning, secured and trade assets, LP actions, and swaps are all up and running. The world's leading Bitcoin DEX is open for business once again."
THORChain operates as one of the crypto industry's primary cross-chain trading layers, with infrastructure for swaps between networks such as Bitcoin and Ethereum. That position has also drawn persistent scrutiny from blockchain investigators who have documented the protocol's use by hackers to move stolen funds across chains, a pattern that predates May's exploit.
The protocol framed the timeline as a deliberate choice.
"This recovery was never about speed, it was about doing it right. Every vault verified, every keyshare checked, every step taken with security and stability as the only priority," THORChain said. "That patience paid off, and the network came back stronger than before."
Upcoming integrations after the restart
In its announcement, THORChain credited the node operators and developers who sustained the process, along with the Maya Protocol team.
"Huge thanks to the node operators who stayed online through every vote and upgrade, the devs who worked relentlessly to ship the fixes, the Maya Protocol team for keeping the lights on, and a community that didn't flinch once," it said.
Monero (XMR) native swaps were confirmed to work end-to-end in internal testing before the restart, and a live launch is described as close. Zcash (ZEC) native swaps and vaults carry a two-week window from the restart date. THORChain separately placed Bittensor (TAO) on a longer timeline, with support expected roughly six weeks after the network's return.
Dynamic fees and deeper liquidity are also on the protocol's near-term roadmap, per Tuesday's announcement.
"THORChain got hit, held the line, and kept shipping. Same chain, same ethos, same mission," the protocol said.
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
