THORChain vault exploit follow-up (2026-05-15): malicious node operator address named in THORChain's own exploit report
- Scam type: Hack
- Chain: Cosmos ecosystem (THORChain)
- Project or site name: THORChain
- Incident date: 2026-05-15
- Reported: 2026-10-23
- Last updated: 2026-10-23
Follow-up to the blockint.ai reports on the 2026-05-15 THORChain vault exploit (https://blockint.ai/c3?report=d2b86b24-2cc0-4ebc-8bfb-39103294b99a and https://blockint.ai/c3?report=d03f6582-11e4-4081-9fa1-50bcf7003652), which list the Bitcoin and Ethereum receiving wallets. This report adds the THORChain node address of the operator THORChain identified as the attacker, which blockint.ai could not accept until bech32 support was added. Primary source: THORChain, "THORChain Exploit Report #1" (https://blog.thorchain.org/thorchain-exploit-report-1). It says about $10.7M was drained from one…
Linked reports: THORChain exploit — attacker addresses (via rekt.news sources), Thorchain Exploit