THORChain co-founder JP Thor lost $1.3M in a suspected Lazarus Group hack, prompting debate over his past defense of DPRK hackers.
Author: Tanishq Bodh
September 12, 2025 – THORChain co-founder JP Thor has lost about $1.3 million in a targeted hack, only months after publicly defending North Korea’s state-backed hackers as “sovereign actors.” Investigators believe the Lazarus Group may be behind the attack, which drained Thor’s personal MetaMask wallet on September 10.
Thor said on X (formerly Twitter) that the breach began when a friend’s Telegram account was hijacked. He received a phishing link disguised as a Zoom invite, which led to a deepfake video call. Attackers used an unpatched browser exploit to steal encrypted iCloud data and keychain credentials without alerting him. His multi-signature Vultisig wallets stayed secure; only a single key share was exposed.
In a twist laced with dark irony, THORChain co-founder JP Thor who recently defended North Korea’s state-backed hackers as exercising “sovereign rights” has fallen prey to what experts believe is a Lazarus Group attack. On September 10, hackers drained about $1.3 million from Thor’s personal MetaMask wallet through a targeted social engineering scam.
Investigators say the assault used a deepfake Zoom call and a phishing link sent from a hijacked Telegram account. Once Thor clicked, a browser zero-day exploit siphoned his iCloud data and keychain credentials without alerting him. “It felt like a ghost in the machine,” Thor posted on X (formerly Twitter). His multi-signature Vultisig wallets since the breach only exposed one key.
Initial reports from PeckShield misread the breach as a protocol exploit, briefly shaking markets. $RUNE, THORChain’s token, dipped 5% before recovering when the team clarified the event was personal. Fees on the network surged 125% in the hour after the alert, likely due to increased scrutiny or opportunistic trades. Three bounties were offered to the attacker, but none have been claimed.
The drama deepened because of Thor’s June 2025 appearance in the documentary “How North Korea Pulled Off the World’s Biggest Robbery.” The film analyzed DPRK’s $1.5 billion Bybit hack, allegedly by Lazarus. Thor, real name John-Paul Thorbjornsen—argued in the program that exploiting loopholes was not inherently wrong. He also admitted THORChain processed $1.2 billion in stolen funds, though he denied personal gains.
Blockchain sleuth ZachXBT called the hack “poetic,” noting Thor had benefited indirectly from Lazarus flows before suffering similar tactics. The method—deepfakes combined with zero-day exploits mirrors the group’s past operations, including the Bangladesh Bank raid. Thor, who helped launch THORChain in 2018, now warns users to abandon single-key wallets. He said the event shows how innovation attracts predators, demanding ever-stronger defenses. Whether the breach softens or hardens his sovereignty stance remains unclear.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Dormant Ethereum Wallets Drained in Mass Exploit
Meteora Loses $1.5M USDC in Fake OTC Escrow Scam
Wasabi Protocol Exploited for Up to $4.5M via Admin-Key Compromise
Sweat Economy Exploit Drains 13.7B SWEAT From NEAR Wallets
Dormant Ethereum Wallets Drained in Mass Exploit
Meteora Loses $1.5M USDC in Fake OTC Escrow Scam
Wasabi Protocol Exploited for Up to $4.5M via Admin-Key Compromise
Sweat Economy Exploit Drains 13.7B SWEAT From NEAR Wallets
