THORChain Founder Loses $1.3 Million in Cryptocurrency Theft

Hackers stole $1.3 million from THORChain founder's wallet.

Hackers accessed the wallet of THORChain founder John-Paul Thorbjornsen, extracting crypto assets worth approximately $1.3 million.

The wallet likely belongs to @jpthor who had a private wallet compromised due to a fake meeting scam a few days ago.

JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits.

So it’s a bit poetic he got rekt here by DPRK. pic.twitter.com/T57RRJ0bbf

— ZachXBT (@zachxbt) September 12, 2025

Initially, analysts suspected a breach of the protocol itself, but network representatives denied these claims. 

“The incident is related to an attack on a user’s personal wallet and is not connected to THORChain,” clarified the team.

Later, on-chain investigator ZachXBT stated that the affected address was linked to Thorbjornsen and that the attack occurred during a fake online meeting. The researcher accused North Korean hackers of the breach. 

“[Thorbjornsen] is one of those who gained significant financial benefit from laundering money from DPRK hacks/exploits. So it’s quite poetic that North Korea caught up with him,” added the analyst.

The THORChain founder also confirmed the rapidly spreading rumors about the breach of his personal wallet. According to a post, on September 4, he received a phishing link to a Zoom meeting on Telegram from a compromised friend’s account.

finally tracked down the source of the attack

friend’s hacked telegram account with a zoom link.

Note: this is the OFFICIAL zoom link and I joined IN THE browser. I literally saw a deep fake of my friend, but couldn’t hear anything so dropped off and tried on google meets.… https://t.co/9s2fIW4z7x pic.twitter.com/Tjx9bX8kSO

— JP (@jpthor) September 8, 2025

After Thorbjornsen clicked the link, the perpetrators used a deepfake of his friend. Within two minutes of conversation, they somehow managed to upload a malicious script to his computer and steal all data. 

On September 12, THORChain began sending on-chain messages to the attackers’ addresses, requesting the return of funds for a reward. 

In August, losses from hacks in the crypto industry amounted to $163 million. Analysts at PeckShield recorded about 16 major attacks.