THORChain Exploit Report #2 — GG20 root-cause disclosure

What it is

Post-mortem of the May 15, 2026 THORChain vault compromise (~$10M). The summary has the shape right; what it omits are the version boundaries, the quantified odds, and the detection signal — the things an engineer running a tss-lib fork actually needs.

Version boundaries

• THORChain's deployed fork was v0.1.6, which predated all three upstream fixes.
• Binance's upstream tss-lib had already fixed all three: two in the v2.0.0 hardening release (August 2023), the third in v3.0.0 (2024) — but each was shipped as an isolated minor issue, so none was flagged as a critical/emergency upgrade.
• A later library version enforces cryptographic well-formedness verification of the Paillier modulus; THORChain had not adopted it because known attacks (BitForge, TSSHOCK) were assessed as not applicable to their version.
• Fixed in THORChain v3.19.1; all validators upgraded and a coordinated cross-vault verification ran before signing resumed.

If you run any GG20/tss-lib fork, the takeaway is that being clear of BitForge/TSSHOCK is not sufficient — the exploitable path is the combination, which no advisory or CVE describes.

The mechanism detail the summary flattens

The malformed multi-prime modulus (the BitForge/TSSHOCK class) on its own is only probabilistically exploitable: roughly 1 in 131,000 chance per signing session of leaking useful information, set by the size of the hidden small prime factors. That alone would need millions of attempts — which is why it was rated low-risk.

The other two flaws remove the probability:

• a range proof that verified its two halves in isolation and never bound the commitment to the ciphertext, letting the attacker encrypt a value of their choosing while still passing the proof;
• a blinding term sampled from too small a range to actually mask the value it covered, leaking a sliver every round.

Layered on the malformed modulus, these convert the statistical gamble into a deterministic leak — full secret share in a fixed, small number of sessions (here, 864 failed MTA rounds over 2.5 days), then the whole vault key.

Detection signal

The only aggregate tell was a single validator responsible for a wildly disproportionate share of key-sign failures over a short window. Per-validator key-sign-failure monitoring would have surfaced it; individual failures and the absorbed slashing penalties all looked like routine node flakiness. Solvency checks and auto-halts never fired because the compromise happened entirely upstream of any fund movement — the drain was a single transaction after the key was already reconstructed.

Scope and other mitigations

• EdDSA-secured chains, including Solana, were never exposed — the flaw is specific to ECDSA/GG20's Paillier arithmetic.
• Damage was capped structurally: attacking another vault meant bonding another node (hundreds of thousands of dollars); the working theory is the attacker lacked the capital.
• Beyond the DKLS/Schnorr migration, proposals under consideration: minimum wallet-age requirement before operating a node, gradual vault exposure for new validators, and a dual-scheme 2-of-2 multisig with each key on independent cryptography.
• The bug bounty was paused March 31, 2026 for one year, citing a surge in low-quality AI-generated submissions.

Caveats

The PoC was only reproduced by two cryptographers working with advanced AI models, with the compromised shares already in hand and knowing where to look — not a push-button exploit. The additional mitigations above are proposals/under consideration, not shipped.