{"id":84265,"date":"2025-09-12T16:15:25","date_gmt":"2025-09-12T13:15:25","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=84265"},"modified":"2025-09-12T16:20:14","modified_gmt":"2025-09-12T13:20:14","slug":"thorchain-founder-loses-1-3-million-in-cryptocurrency-theft","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft\/","title":{"rendered":"THORChain Founder Loses $1.3 Million in Cryptocurrency Theft"},"content":{"rendered":"<p>Hackers accessed the wallet of THORChain founder John-Paul Thorbjornsen, extracting crypto assets worth approximately $1.3 million.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">The wallet likely belongs to <a href=\"https:\/\/twitter.com\/jpthor?ref_src=twsrc%5Etfw\">@jpthor<\/a> who had a private wallet compromised due to a fake meeting scam a few days ago. <\/p>\n<p>JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks\/exploits. <\/p>\n<p>So it\u2019s a bit poetic he got rekt here by DPRK. <a href=\"https:\/\/t.co\/T57RRJ0bbf\">pic.twitter.com\/T57RRJ0bbf<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/1966415195137519909?ref_src=twsrc%5Etfw\">September 12, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Initially, analysts suspected a breach of the protocol itself, but network representatives <a href=\"https:\/\/x.com\/THORChain\/status\/1966412686758986002\">denied<\/a> these claims.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cThe incident is related to an attack on a user&#8217;s personal wallet and is not connected to THORChain,\u201d clarified the team.<\/p>\n<\/blockquote>\n<p>Later, on-chain investigator ZachXBT stated that the affected address was linked to Thorbjornsen and that the attack occurred during a fake online meeting. The researcher accused North Korean hackers of the breach.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201c[Thorbjornsen] is one of those who <a href=\"https:\/\/forklog.com\/en\/news\/hacker-linked-to-300-million-coinbase-theft-swaps-45-million-via-thorchain\">gained significant financial benefit<\/a> from laundering money from DPRK hacks\/exploits. So it\u2019s quite poetic that North Korea caught up with him,\u201d added the analyst.<\/p>\n<\/blockquote>\n<p>The THORChain founder also confirmed the rapidly spreading rumors about the breach of his personal wallet. According to a post, on September 4, he received a phishing link to a Zoom meeting on Telegram from a compromised friend&#8217;s account.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">finally tracked down the source of the attack<\/p>\n<p>friend&#8217;s hacked telegram account with a zoom link.<\/p>\n<p>Note: this is the OFFICIAL zoom link and I joined IN THE browser. I literally saw a deep fake of my friend, but couldn&#8217;t hear anything so dropped off and tried on google meets.\u2026 <a href=\"https:\/\/t.co\/9s2fIW4z7x\">https:\/\/t.co\/9s2fIW4z7x<\/a> <a href=\"https:\/\/t.co\/Tjx9bX8kSO\">pic.twitter.com\/Tjx9bX8kSO<\/a><\/p>\n<p>\u2014 JP (@jpthor) <a href=\"https:\/\/twitter.com\/jpthor\/status\/1964886838990000200?ref_src=twsrc%5Etfw\">September 8, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\u00a0<\/p>\n<p>After Thorbjornsen clicked the link, the perpetrators used a deepfake of his friend. Within two minutes of conversation, they somehow managed to upload a malicious script to his computer and steal all data.\u00a0<\/p>\n<p>On September 12, THORChain began sending on-chain messages to the attackers&#8217; addresses, requesting the return of funds for a reward.\u00a0<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"343\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-416ccae928d68a5c-4075407020137628-1024x343.png\" alt=\"image\" class=\"wp-image-265715\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-416ccae928d68a5c-4075407020137628-1024x343.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-416ccae928d68a5c-4075407020137628-300x100.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-416ccae928d68a5c-4075407020137628-768x257.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-416ccae928d68a5c-4075407020137628.png 1099w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/etherscan.io\/idm?addresses=0xad3111cbcf4580ca05bb2d14a3a35c40a1b89af2,0xac0eb0be4c5db74ad946cda1043e4b9ccc9728bb&#038;type=1\">Etherescan<\/a>.<\/figcaption><\/figure>\n<p>In August, losses from hacks in the crypto industry amounted to $163 million. Analysts at PeckShield <a href=\"https:\/\/forklog.com\/en\/news\/august-crypto-hacks-result-in-163-million-losses\">recorded<\/a> about 16 major attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers accessed the wallet of THORChain founder John-Paul Thorbjornsen, extracting crypto assets worth approximately $1.3 million.<\/p>\n","protected":false},"author":1,"featured_media":84266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Hackers stole $1.3 million from THORChain founder's wallet.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1750],"class_list":["post-84265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-thorchain"],"aioseo_notices":[],"amp_enabled":true,"views":"429","promo_type":"1","layout_type":"1","short_excerpt":"Hackers stole $1.3 million from THORChain founder's wallet.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/84265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=84265"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/84265\/revisions"}],"predecessor-version":[{"id":84267,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/84265\/revisions\/84267"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/84266"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=84265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=84265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=84265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}