Data leak [loss] $1M+

"THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder's wallet"

2025-09-09 [vendor] Thorchain founder
Primary Source ↗
Financial Loss $1.3M (1,350,000 USD)

Incident Details

John-Paul Thorbjornsen, the founder of Thorchain and Vultisig, suffered a wallet drain, reportedly after experiencing a video meeting scam from an attacker who had exploited the Telegram account belonging to one of his friends. According to JP, the scammer used a malicious video call link to place malware on his computer, which then exfiltrated private keys for one of his crypto wallets. Some questioned whether he had made up the story, as he immediately began using the story to promote his Vultisig product.Later that week, Thorbjornsen apparently suffered another loss — this one confirmed on-chain to be around $1.35 million.According to crypto sleuth zachxbt, the attackers appeared to be a part of North Korean crypto hacking operations. “JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits. So it’s a bit poetic he got rekt here by DPRK,” he wrote.

Total loss estimated at $1,350,000.

Technical Details

Initial Attack Vector
Smart contract exploit / hack
Vendor / Product
Thorchain founder

Timeline

  1. 2025-09-09 Breach occurred
  2. 2025-09-09 Publicly disclosed