THORSwap Offers $1,2 Million Bounty After Hack
- THORSwap proposes a reward to recover stolen funds
- THORChain Founder Lost $1,35 Million in Attack
- PeckShield confirms protocol has not been compromised
DEX aggregator THORSwap announced an onchain bounty offering to recover funds following the exploitation of a personal wallet linked to the THORChain ecosystem. According to PeckShield, the loss was estimated at approximately $1,2 million.
On-chain detective ZachXBT pointed out that the victim of the attack is likely John-Paul Thorbjornsen, founder of THORChain. He reportedly lost approximately $1,35 million in a scam linked to North Korean hackers. "Bounty offer: Return $THOR as a reward. Contact
or with the THORSwap Discord to get an OTC offer,” the message sent to the attacker The note added: “No legal action will be taken if the amount is returned within 72 hours.”
Initially, PeckShield signaled that the incident could be related to the protocol itself. However, after clarification from the team, it was confirmed that the exploit only affected one user's personal wallet. "This incident involved a user's personal wallet being exploited and is not related to THORChain," the project team stated. The CEO, known as "Paper X," reinforced that neither THORChain nor THORSwap were compromised.
Hey @imcryptofreak , this incident involved a user's personal wallet being exploited, and is not related to @THORChain . Time to pin your post. 🤓 https://t.co/lFDxw5DQWC
— THORChain (@THORChain) September 12, 2025
According to Thorbjornsen, the attack began when he received a message from a friend on Telegram, whose account had been hacked. The malicious link, disguised as an invitation to a Zoom meeting, led to the compromise of an old MetaMask account stored in a Chrome profile and synced with iCloud Keychain. He noted that the attackers may have used a zero-day exploit, highlighting the importance of multi-signature wallets as a more secure alternative.
ZachXBT detailed that the hackers siphoned approximately $1,03 million in Kyber Network tokens and another $320 in THORSwap assets. The funds were sent to an address identified as "Exploiter 6," where the reward messages were also received. Some of the funds had already been converted to ETH at an address beginning with "0x7Ab," according to onchain tracking.
The case reinforces the growing use of onchain rewards as a trading mechanism to recover funds lost in attacks targeting the cryptocurrency sector.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
$8.8 billion outflow countdown: MSTR is becoming the abandoned child of global index funds
The final result will be revealed on January 15, 2026, and the market has already started to vote with its feet.

Deconstructing DAT: Beyond mNAV, How to Identify "Real vs. Fake HODLing"?
There is only one iron rule for investing in DAT: ignore premium bubbles and only invest in those with a genuine flywheel of continuously increasing "crypto per share."

Empowered by AI Avatars, How Does TwinX Create Immersive Interaction and a Value Closed Loop?
1. **Challenges in the Creator Economy**: Web2 content platforms suffer from issues such as opaque algorithms, non-transparent distribution, unclear commission rates, and high costs for fan migration, making it difficult for creators to control their own data and earnings. 2. **Integration of AI and Web3**: The development of AI technology, especially AI Avatar technology, combined with Web3's exploration of the creator economy, offers new solutions aimed at breaking the control of centralized platforms and reconstructing content production and value distribution. 3. **Positioning of the TwinX Platform**: TwinX is an AI-driven Web3 short video social platform that aims to reconstruct content, interaction, and value distribution through AI avatars, immersive interactions, and a decentralized value system, enabling creators to own their data and income. 4. **Core Features of TwinX**: These include AI avatar technology, which allows creators to generate a learnable, configurable, and sustainably operable "second persona", as well as a closed-loop commercialization pathway that integrates content creation, interaction, and monetization. 5. **Web3 Characteristics**: TwinX embodies the assetization and co-governance features of Web3. It utilizes blockchain to confirm and record interactive behaviors, turning user activities into traceable assets, and enables participants to engage in platform governance through tokens, thus integrating the creator economy with community governance.

Aster CEO explains in detail the vision of Aster privacy L1 chain, reshaping the decentralized trading experience
Aster is set to launch a privacy-focused Layer 1 (L1) public chain, along with detailed plans for token empowerment, global market expansion, and liquidity strategies.

