THORChain Multichain Vault Exploit — GG20 TSS Weakness (Suspected)

Timeline: On May 15, 2026 (morning UTC), an attacker drained approximately $10.8M from one of six THORChain Asgard vaults across Bitcoin, Ethereum, BSC, and Base. ZachXBT initially flagged the suspicious outflows on Telegram, with Arkham and PeckShield confirming the consolidation. The root cause is suspected to involve the GG20 TSS (Threshold Signature Scheme) primitive used by THORChain validator nodes, with Ledger CTO Charles Guillemet and protocol contributors pointing to MPC wallet security as the fundamental concern. The compromised validator node thor16ucjv3v695mq283me7esh0wdhajjalengcn84q had been churned into the active set days before the attack. Chainalysis later traced pre-attack laundering activity from Monero through Hyperliquid to Arbitrum, indicating multi-week preparation. THORChain executed an emergency Mimir trading and signing halt and paused all node activity for 12 hours 42 minutes starting at block 26190429. RUNE dropped 12-15% in the hours following. The treasury team is coordinating with THORSec, Outrider Analytics, and law enforcement. No post-mortem published as of May 16.