# THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend

- Severity: Critical · Status: Still active (past)
- Chains: Ethereum · Method: Social engineering and fake support
- Started: Sep 4, 2025 · Last update: Sep 12, 2025 · Reported stolen: $1.4M · Victims: 1
- Who/what: THORChain co-founder's personal wallet
- AI involvement: AI-made lures. The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account.

In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.

## Am I affected?
If a contact's Telegram sent you a Zoom or Meet link, and on the call you saw them but heard nothing, assume the account was hijacked and the call was fake.

## What to do now
- From a clean device, move funds out of every wallet, including old or forgotten ones, whose keys were on that computer or in its synced password store.
- Log out all other Telegram sessions and change passwords and 2FA.
- Warn the friend on another channel.

## How to avoid this
- Seeing a friend's face on a call is no longer proof; confirm by phone or another channel you already trust.
- Do not keep seed phrases or private keys in iCloud Keychain, browser profiles or notes.
- Retire old hot wallets and keep larger funds on a hardware wallet.

## Indicators (block these, never visit them)
- Address: 0x37cdb6b40861f350e23aa5733e75755fcbed739f
- Address: 0xac0eb0be4c5db74ad946cda1043e4b9ccc9728bb

## Sources
- THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder's wallet (The Block, 2025-09-12): https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user
- THORChain founder loses $1.3 million in cryptocurrency theft (ForkLog, 2025-09-12): https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/

Full record: https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025 · JSON: https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.