- Scam type: Hack
- Chain: Cosmos ecosystem (THORChain)
- Project or site name: THORChain
- Incident date: 2026-05-15
- Reported: 2026-10-23
- Last updated: 2026-10-23
Follow-up to the blockint.ai reports on the 2026-05-15 THORChain vault exploit (https://blockint.ai/c3?report=d2b86b24-2cc0-4ebc-8bfb-39103294b99a and https://blockint.ai/c3?report=d03f6582-11e4-4081-9fa1-50bcf7003652), which list the Bitcoin and Ethereum receiving wallets. This report adds the THORChain node address of the operator THORChain identified as the attacker, which blockint.ai could not accept until bech32 support was added. Primary source: THORChain, "THORChain Exploit Report #1" (https://blog.thorchain.org/thorchain-exploit-report-1). It says about $10.7M was drained from one…
Other addresses in this report: thor16ucjv3v695mq283me7esh0wdhajjalengcn84q
Linked reports: THORChain exploit — attacker addresses (via rekt.news sources), Thorchain Exploit