OAK — OnChain Attack Knowledge

Worked example · 2026-05

THORChain — a node that joined two days earlier failed 864 signing rounds on purpose, collected leaked key fragments, and reconstructed a vault's private key — THORChain / Ethereum, BSC, Base, Bitcoin, Avalanche, Tron and others — 2026-05-15

Loss
~$10M per THORChain's own report; $10.7M in most coverage (ZachXBT's alert, rekt); TRM Labs later put the total above $11M. The first official estimate was ~$7.4M and was revised upward. One of THORChain's six Asgard vaults was drained in a single outbound transaction per chain; chains secured by a different signature scheme (e.g. Solana) were not exposed. Losses were absorbed under governance (ADR-028); there was no user refund portal.
OAK Techniques observed
OAK-T10.001 (Validator / Signer Key Compromise — primary, operator-confirmed. The attacker obtained the vault's full threshold-signing key. It did so not by stealing other signers' shares but by participating in signing as a validator and extracting key material from the protocol itself: THORChain's fork of Binance tss-lib (v0.1.6, GG20 ECDSA) carried three weaknesses that upstream had fixed in v2.0.0 (2023) and v3.0.0 (2024) — the Paillier modulus was not checked to be a true biprime, the two halves of a range proof were not bound to the ciphertext, and a blinding term was drawn from too small a range. Combined, they leaked a sliver of key material in every MtA signing round. See techniques/T10.001-validator-signer-key-compromise.md). OAK-T11.013 (Legacy-Version Maintenance Attack Surface — the fork was about three years and two major security releases behind upstream).
Attribution
pseudonymous. Malicious node thor16ucjv3v695mq283me7esh0wdhajjalengcn84q, bonded ~635,000 RUNE across two addresses; Chainalysis reports the entry was funded through Monero from late April. The node joined the developer Discord on 2026-05-01 asking how to churn in quickly.
Corrected 2026-10-11
this entry previously classified the incident as OAK-T10.008 (Bridge Observer Signature Scope Truncation): a malicious proposer flipping an unsigned direction flag in Bifrost's ObservedTx wrapper. That mechanism came from a third-party analysis published on the day of the exploit. THORChain's Exploit Report #2 (2026-07-03) attributes the loss to GG20 key-material leakage and does not mention Bifrost, observers, the router, or a direction flag. The observer-wrapper weakness was real — THORNode patched it in a commit dated 2026-05-06, "sign full ObservedTx wrapper to prevent proposer forgery" — but rekt and THORChain treat it as an early indicator, not the cause. T10.008 has been deprecated; see its tombstone.
Key teaching point
A threshold-signature scheme is only as strong as its implementation's checks on what each participant contributes. GG20 lets every signer feed values into every other signer's computation; a library that does not verify those values turns each signing round into a small leak, and a patient insider can run as many rounds as it likes. THORChain's own report names the signal that would have caught it: one validator accounting for a disproportionate share of signing failures — 864 failed rounds in ~2.5 days. Permissionless validator entry plus an un-upgraded TSS library meant anyone with a bond could become that insider.

Summary

On 2026-05-13 a new node operator churned into THORChain's active set and was assigned to one of six Asgard vaults. Over the next ~2.5 days it deliberately caused 864 signing rounds to fail at the MtA step, each failure leaking a fragment of the vault's key through the three weaknesses in THORChain's GG20 library. Once enough material had accumulated it reconstructed the vault's private key and, on 2026-05-15, moved the vault's funds to attacker addresses in single transactions per chain. Because the key was already compromised before the outflow, THORChain's solvency checker and automatic halts could not intervene in time. ZachXBT raised the alert; node operators halted trading and signing via Mimir; the network stayed paused for over a month while validators upgraded to v3.19.1 and every vault was verified.

Timeline (UTC)

When Event OAK ref
late April 2026 Attacker funds node bond via Monero (Chainalysis) (preparation)
2026-05-01 Node operator asks on developer Discord how to churn in quickly (preparation)
2026-05-06 THORNode commit signs the full ObservedTx wrapper (separate, unexploited weakness) —
2026-05-13 Malicious node churns in (~635K RUNE bond), assigned to one Asgard vault T10.001 (insider position)
2026-05-13 → 05-15 864 deliberately failed signing rounds leak key material T10.001, T11.013
2026-05-15 Vault key reconstructed; funds moved out (~$6.77M on Ethereum alone to 0xd477b695…90Bd) T10.001 extraction
2026-05-15 ZachXBT alert; Mimir trading and signing halt; official statement >5 h later (response)
2026-05-20 THORChain Exploit Report #1 (disclosure)
2026-07-03 THORChain Exploit Report #2 — root cause published (disclosure)
~2026-06 Trading resumes after >5-week pause; validators on v3.19.1 (recovery)

What defenders observed

  • Signing-failure concentration. One validator responsible for a disproportionate share of failed signing rounds over a short window. THORChain names this as the early-warning signal it missed.
  • New-entrant exposure. The node had been active for two days and was immediately trusted with a share of a live vault. THORChain is weighing wallet-age requirements and gradual vault exposure for new validators.
  • Upstream drift. The TSS fork predated public fixes for exactly the classes of weakness exploited.

Root-cause evidence

  • Technique: OAK-T10.001
  • Source: https://blog.thorchain.org/thorchain-exploit-report-2
  • Source type: operator
  • Confidence: confirmed
  • Evidence: THORChain Exploit Report #2: a validator that churned in two days earlier caused 864 MtA signing rounds to fail, harvesting key material through three weaknesses in its tss-lib v0.1.6 fork (unverified Paillier modulus, unbound range proof, narrow blinding), and reconstructed a vault key. The report does not mention Bifrost, observers or a direction flag.

Public references

Discussion

Why this was misfiled, for the record. The first technical explanation available was a detailed, confident third-party analysis built on a real code change: THORNode had just patched an unsigned field in observer signatures. It read the vault-migration that followed churn as a forged migration to an attacker address — but that address was the new vault itself, which the attacker sat inside as a signer. OAK minted a new Technique (T10.008) from that single analysis on the day of the exploit and never revisited it when THORChain published its root cause seven weeks later. This is the same failure as the KelpDAO entry: an open investigation recorded as settled, and never re-checked against the operator's report.

Boundary with T10.001. T10.001's classic anchors (Ronin, Harmony) are keys stolen from signers by phishing or intrusion. Here the attacker was a signer, admitted permissionlessly, and extracted the shared key through the protocol. The Technique fits — the attacker ended up holding the signing key — but the sub-shape is distinct and is recorded in TAXONOMY-GAPS as a candidate: threshold-signature key extraction by a malicious participant.

Techniques demonstrated (2)