THORChain Founder's Wallet Drained by Social Engineering Attack → Security

An abstract composition features numerous faceted blue crystals and dark blue geometric shapes, interspersed with white spheres and thin metallic wires, all centered within a dynamic structure. A thick, smooth white ring partially encompasses this intricate arrangement, set against a clean blue-grey background

A translucent, dark blue toroidal object, filled with glowing blue bubble-like structures, features a prominent metallic mechanism with a silver tip on its side, set against a plain grey background. This intricate 3D render visually represents a complex decentralized autonomous organization DAO or a Layer 2 scaling solution within the blockchain ecosystem

Briefing

On September 18, 2025, John-Paul Thorbjornsen, the founder of THORChain, became the victim of a sophisticated social engineering attack that resulted in the compromise of his personal MetaMask wallet. The incident led to the theft of approximately $1.35 million in digital assets, specifically Kyber Network and THORSwap tokens. This exploit highlights the persistent vulnerability of individual digital asset holders to advanced phishing tactics, even within the leadership of prominent DeFi protocols. The stolen funds were subsequently moved into Ethereum, prompting THORSwap to issue an on-chain bounty for their return.

A translucent, frosted rectangular device with rounded corners is depicted, featuring a central circular lens and two grey control buttons on its right side. Inside the device, a vibrant blue, textured, organic-like structure is visible through the clear lens, resting on a dark blue base

Context

Prior to this incident, the broader Web3 ecosystem has faced a continuous onslaught of social engineering attacks, targeting not just end-users but also high-profile individuals within projects. These attacks frequently leverage compromised communication channels or deceptive links to gain unauthorized access to private keys or seed phrases. The prevailing attack surface often includes personal digital environments, where even robust protocol-level security cannot protect against individual operational security failures.

The detailed composition showcases a technological device partially encased in a textured, crystalline material, featuring glowing blue lines connecting various dark, metallic circuit elements. A prominent silver cylindrical component extends from the right side, integrated into the complex structure

Analysis

The attack was executed through a social engineering vector, where the perpetrator sent a fake Zoom link from a friend’s compromised Telegram account. This deceptive maneuver tricked the victim into unknowingly granting access to multiple older private-key wallets. Once compromised, the attackers exfiltrated approximately $1.03 million in Kyber Network tokens and $320,000 in THORSwap tokens.

The funds were then consolidated and transferred to Ethereum, indicating a planned laundering attempt. This method bypasses smart contract security by directly targeting the user’s private key management.

The image showcases a detailed view of a translucent, frosted white and vibrant blue mechanical component, highlighting its intricate internal structure and smooth exterior. The focus is on the interplay of light and shadow across its precise, engineered surfaces, with a prominent blue ring providing a striking color contrast

Parameters

Protocol Affected → N/A (Personal Wallet Compromise)
Victim → John-Paul Thorbjornsen (THORChain Founder)
Attack Vector → Social Engineering, Private Key Compromise
Financial Impact → $1.35 Million
Assets Stolen → Kyber Network Tokens ($1.03M), THORSwap Tokens ($320K)
Blockchain Involved → Ethereum (for fund movement)
Date of Incident → September 18, 2025
Threat Actor Attribution → Linked to North Korean hackers

The image displays an intricate assembly of polished silver-toned rings, dark blue plastic connectors, and numerous thin metallic wires. These elements are tightly interwoven, creating a dense, technical composition against a blurred blue background, highlighting precision engineering

Outlook

Immediate mitigation for users involves heightened vigilance against unsolicited links and a rigorous adherence to multi-factor authentication and hardware wallet usage for all high-value digital assets. Protocols should reinforce educational campaigns on personal operational security for their teams and community members, emphasizing that even sophisticated smart contract audits cannot prevent private key compromise. This incident will likely drive further adoption of advanced phishing detection tools and secure communication protocols within the Web3 space, establishing new best practices for safeguarding individual digital identities.

The compromise of a prominent founder’s personal wallet underscores that human-factor vulnerabilities remain a critical and often underestimated vector for significant digital asset theft, demanding a systemic re-evaluation of individual operational security across the ecosystem.

Signal Acquired from → bankinfosecurity.com