{
 "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
 "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
 "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
 "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "ai": {
  "role": "ai-lure",
  "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account."
 },
 "chains": [
  "ethereum"
 ],
 "method": "social-engineering",
 "product": "THORChain co-founder's personal wallet",
 "tags": [
  "ethereum",
  "social-engineering",
  "dprk",
  "deepfake",
  "zoom",
  "fake-meeting",
  "telegram",
  "account-takeover",
  "metamask",
  "zachxbt",
  "thorchain",
  "thorswap",
  "ai"
 ],
 "amountUsd": 1350000,
 "victims": 1,
 "startedAt": "2025-09-04",
 "closedAt": "2025-09-12",
 "updatedAt": "2025-09-12T12:00:00Z",
 "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.",
 "timeline": [
  {
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/"
  },
  {
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user"
  },
  {
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder's wallet",
   "url": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "publisher": "The Block",
   "date": "2025-09-12"
  },
  {
   "kind": "news",
   "title": "THORChain founder loses $1.3 million in cryptocurrency theft",
   "url": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "publisher": "ForkLog",
   "date": "2025-09-12"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "0x37cdb6b40861f350e23aa5733e75755fcbed739f",
   "0xac0eb0be4c5db74ad946cda1043e4b9ccc9728bb"
  ]
 },
 "brief": "## Am I affected?\nIf a contact's Telegram sent you a Zoom or Meet link, and on the call you saw them but heard nothing, assume the account was hijacked and the call was fake.\n\n## What to do now\n- From a clean device, move funds out of every wallet, including old or forgotten ones, whose keys were on that computer or in its synced password store.\n- Log out all other Telegram sessions and change passwords and 2FA.\n- Warn the friend on another channel.\n\n## How to avoid this\n- Seeing a friend's face on a call is no longer proof; confirm by phone or another channel you already trust.\n- Do not keep seed phrases or private keys in iCloud Keychain, browser profiles or notes.\n- Retire old hot wallets and keep larger funds on a hardware wallet.",
 "notes": null,
 "agentBrief": "# THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Ethereum · Method: Social engineering and fake support\n- Started: Sep 4, 2025 · Last update: Sep 12, 2025 · Reported stolen: $1.4M · Victims: 1\n- Who/what: THORChain co-founder's personal wallet\n- AI involvement: AI-made lures. The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account.\n\nIn early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.\n\n## Am I affected?\nIf a contact's Telegram sent you a Zoom or Meet link, and on the call you saw them but heard nothing, assume the account was hijacked and the call was fake.\n\n## What to do now\n- From a clean device, move funds out of every wallet, including old or forgotten ones, whose keys were on that computer or in its synced password store.\n- Log out all other Telegram sessions and change passwords and 2FA.\n- Warn the friend on another channel.\n\n## How to avoid this\n- Seeing a friend's face on a call is no longer proof; confirm by phone or another channel you already trust.\n- Do not keep seed phrases or private keys in iCloud Keychain, browser profiles or notes.\n- Retire old hot wallets and keep larger funds on a hardware wallet.\n\n## Indicators (block these, never visit them)\n- Address: 0x37cdb6b40861f350e23aa5733e75755fcbed739f\n- Address: 0xac0eb0be4c5db74ad946cda1043e4b9ccc9728bb\n\n## Sources\n- THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder's wallet (The Block, 2025-09-12): https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user\n- THORChain founder loses $1.3 million in cryptocurrency theft (ForkLog, 2025-09-12): https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/\n\nFull record: https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025 · JSON: https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}