THORChain — ~$11M cross-chain vault drain on a Switzerland-based protocol

A malicious validator node drained approximately $11M in protocol-owned funds from THORChain — a Switzerland-based decentralised cross-chain liquidity protocol — across nine chains on 2026-05-15, covered 2026-05-18. Notable for this audience only as a Swiss-nexus financial-infrastructure incident; the root cause is a threshold-signature (GG20) vault-control failure rather than a defender-actionable enterprise TTP.