THORChain Silently Patches Critical Bug After Bounty Retirement

HypeMeter

High attention and emotional sentiment detected.

V12 Security, led by researcher William Bowling, posted the disclosure on X at 10:57 UTC. The firm also warned it holds additional chain-halt DoS vulnerabilities for open disclosure in coming days.

No funds were lost from this THORChain critical bug. The team patched the issue before V12 went public. Still, the disclosure raises serious questions about how DeFi protocols treat security researchers.

How the THORChain Critical Bug Worked

V12 reported the bug privately to THORChain on April 28, 2026. The firm called it an “attestation-finality-bypass” flaw. It also published a full proof-of-concept on GitHub.

In a cross-chain DEX like THORChain, inbound deposits must reach a confirmation threshold before swaps execute. This prevents attackers from depositing on one chain and reversing the transaction after receiving funds on another.

The THORChain critical bug allowed a single malicious validator to modify unsigned metadata in a transaction observation. Acting as the CometBFT block proposer, the attacker could alter the FinaliseHeight field in an ObservedTx. This would fake the confirmation status of an inbound deposit.

Once the protocol believed the deposit was confirmed, it would execute the swap from its liquidity pools. The attacker could then double-spend the source-chain deposit. On Bitcoin, for example, this could drain pool funds.

THORChain’s Silent Patch

THORChain acknowledged the report and merged a fix via GitLab Merge Request 4820. The fix landed in the private repository by May 28, 2026. The team did not announce the patch publicly.

When V12 asked about compensation, THORChain reportedly told V12 that it had permanently retired its bounty program. According to THORChain’s contributors page, the program ended in March 2026 alongside the v3.16.0 release.

THORChain originally used Immunefi for bug bounties. It later moved to a self-hosted program before retiring bounties entirely. As of June 1, the protocol has issued no official statement on V12’s disclosure.

V12 Threatens More Disclosures

V12 stated on X that it holds additional THORChain vulnerabilities. These reportedly include chain-halt DoS bugs that could trigger the network’s emergency pause mechanism.

“We have more Thorchain chain halt DoS vulns,” V12 wrote. “We intend to release them (open disclosure) in the coming few days.”

Open disclosure means publishing PoC exploits publicly without an embargo period. This contrasts with responsible disclosure, where researchers give the team time to patch first. V12 chose the open path after receiving no bounty.

A Pattern of Security Failures

This is not the first THORChain critical bug to surface. The protocol suffered two exploits in July 2021, each costing roughly $5 million.

On May 15, 2026, a malicious node exploited a flaw in THORChain’s GG20 threshold signature scheme. That attack drained $10.7 million from protocol vaults. Trading remains paused since that incident.

THORChain’s TVL currently sits at $30 million, according to DefiLlama. That figure is down 25.84% over the past 30 days. RUNE trades at $0.4178 with a fully diluted valuation of $150.28 million, per CoinGecko.

Community Reaction Turns Negative

On X, sentiment skews heavily against THORChain’s security practices. On-chain investigator ZachXBT commented, “You would figure after all of the exploits they had security would be taken more seriously.”

Other researchers echoed similar frustrations. One user, @im_kosta, claimed they had the same experience in 2024 after reporting a vulnerability. Another, @only01Essential, wrote, “This is why I don’t think whitehats are to blame… really sad to see.”

Some community members did question V12’s motives. They noted V12 reported the bug in April, a month after the bounty ended. Still, no coordinated defense from THORChain supporters has emerged.

The Bigger DeFi Bounty Problem

THORChain is not alone in cutting security incentives. Several DeFi protocols have retired or reduced bounty programs since the 2024-2025 exploit wave. This trend alarms researchers who depend on bounties for compensation.

Without bounty programs, researchers face a difficult choice. They can disclose for free, sell exploits on gray markets, or go public to build reputation. V12 chose the third option.

V12 Security has built credibility through Linux kernel disclosures in May 2026. These include DirtyCBC, DirtyDecrypt, and Fragnesia (CVE-2026-46300). The firm specializes in agentic-AI-assisted vulnerability discovery.

What Comes Next for THORChain

THORChain still has not resumed trading after the May 15 exploit. V12’s additional DoS disclosures add more pressure on the protocol’s security posture.

The core question is simple. If a protocol retires its bounty, why would researchers report privately? V12’s answer appears to be: they will not.

The open disclosures may be just beginning.

This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.