THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend
THORChain co-founder's personal wallet
In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.
Why this severity: $1.4M reported stolen, 1 victims, still active.
AI involvement
AI-made lures. The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- Sep 4, 2025
- Closed
- Sep 12, 2025
- Chains
- Ethereum
- Reported stolen
- $1.4M
- Victims
- 1
Indicators · never visit or send to these
- 0x37cdb6b40861f350e23aa5733e75755fcbed739f
- 0xac0eb0be4c5db74ad946cda1043e4b9ccc9728bb
What to do now
- From a clean device, move funds out of every wallet, including old or forgotten ones, whose keys were on that computer or in its synced password store.
- Log out all other Telegram sessions and change passwords and 2FA.
- Warn the friend on another channel.
Stay safe
Am I affected?
If a contact's Telegram sent you a Zoom or Meet link, and on the call you saw them but heard nothing, assume the account was hijacked and the call was fake.
What to do now
- From a clean device, move funds out of every wallet, including old or forgotten ones, whose keys were on that computer or in its synced password store.
- Log out all other Telegram sessions and change passwords and 2FA.
- Warn the friend on another channel.
How to avoid this
- Seeing a friend's face on a call is no longer proof; confirm by phone or another channel you already trust.
- Do not keep seed phrases or private keys in iCloud Keychain, browser profiles or notes.
- Retire old hot wallets and keep larger funds on a hardware wallet.
Timeline 3
ForkLog reported his account of seeing a deepfake of his friend on the call.
SourceThe Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.
SourceHe received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.
Source
News & write-ups ›2
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.