Home · Live brief · Weekly 2026-W21
THORChain — ~$11M cross-chain vault drain on a Switzerland-based protocol
notable incident discovered 2026-05-18 05:00 UTC single-source
Part of run 2026-W21-473d6fa5 (weekly · Claude Opus 4.7)
A malicious validator node drained approximately $11M in protocol-owned funds from THORChain — a Switzerland-based decentralised cross-chain liquidity protocol — across nine chains on 2026-05-15, covered 2026-05-18. Notable for this audience only as a Swiss-nexus financial-infrastructure incident; the root cause is a threshold-signature (GG20) vault-control failure rather than a defender-actionable enterprise TTP.