{
 "tag": "thorchain",
 "name": "Thorchain",
 "group": "Other",
 "incidents": [
  {
   "slug": "dcent-app-wallet-seed-compromise-sep-2026",
   "title": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026",
   "json": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum",
    "tron",
    "bitcoin"
   ],
   "method": "key-leak",
   "product": "D'CENT mobile App Wallet users (wallets created in the app)",
   "tags": [
    "ethereum",
    "tron",
    "bitcoin",
    "key-leak",
    "dcent",
    "iotrust",
    "mobile-wallet",
    "seed-phrase",
    "xrp",
    "thorchain"
   ],
   "amountUsd": 18000000,
   "victims": 6678,
   "startedAt": "2026-09-15",
   "closedAt": null,
   "updatedAt": "2026-09-28T12:00:00Z",
   "summary": "From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything."
  },
  {
   "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account."
   },
   "chains": [
    "ethereum"
   ],
   "method": "social-engineering",
   "product": "THORChain co-founder's personal wallet",
   "tags": [
    "ethereum",
    "social-engineering",
    "dprk",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "metamask",
    "zachxbt",
    "thorchain",
    "thorswap",
    "ai"
   ],
   "amountUsd": 1350000,
   "victims": 1,
   "startedAt": "2025-09-04",
   "closedAt": "2025-09-12",
   "updatedAt": "2025-09-12T12:00:00Z",
   "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected."
  }
 ],
 "changes": [
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-28",
   "title": "Protos reported more than 7,000 wallets drained, over $18M stolen and 6.3M XRP moved to Ethereum via THORChain, with no recoveries.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-21",
   "title": "Drains continued, with 640,370 more XRP taken after 21 September.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-17",
   "title": "D'CENT's status report said its latest app includes a check to show users whether they need to act.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-15",
   "title": "The first of at least six drain waves (through 20 September) hit D'CENT app wallets, taking about 11.7M XRP from 6,678 wallets per xrpl.to.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  }
 ]
}