ZachXBT: $1.2M Theft Address Likely Belongs to THORChain Founder John-Paul
By: theblockbeats.news|03/28/2026 08:27:16
0
Share
Prefer us on Google
BlockBeats News, September 12th, On-chain detective ZachXBT commented on the "A THORChain User Was Hacked for $1.2 Million" incident, suggesting that the address may belong to THORChain founder John-Paul Thorbjornsen (JP, @jpthor), whose private wallet was compromised a few days ago due to a fake conference scam. "JP is one of those who has greatly benefited from laundering money through North Korean hacker attacks/vulnerability exploits. Therefore, he suffered losses due to a North Korean-related retaliatory attack, somewhat echoing the idea of karma."
BlockBeats Note: JP's "relationship" with North Korean hackers (mainly the Lazarus Group) is not direct cooperation or personal contact but stems from the THORChain protocol's stance in the 2025 Bybit exchange hack incident. In February 2025, North Korean hackers stole around $1.4 billion worth of cryptocurrency from Bybit, making it one of the largest crypto thefts in history. These hackers then used THORChain as the primary tool to launder the stolen funds, bridging 85% of the stolen funds (approximately $1.2 billion) and converting them into other assets to evade tracking.
-- Price
--
--
--
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
THORChain records $3.01 million September income, 63% from Bitget hack surge
Bitget-linked flows helped drive THORChain’s busiest stretch in more than a year after the protocol rejected selective censorship.
Bitget hack laundering generated $761,725 in fees, researcher finds
Zcash Criticized by Samson Mow After Market Cap Surpasses $22 Billion
Zcash has once again become the center of controversy in the crypto market: JAN3 CEO and Bitcoin supporter Samson Mow questioned the sustainability of the ZEC rally and stated that after the market capitalization surpassed $22 billion, the asset faces an inevitable correction. According to Mow, the ...
ZEC Liquidity Pool Launched, THORChain Trading Function Enters Next Phase
Zachxbt Identifies Five Intermediaries Involved in Cashing Out Stolen Cryptocurrency from Bitget
Zachxbt, an anonymous on-chain researcher, has revealed the aliases of five individuals he suspects of being involved in cashing out and laundering cryptocurrency stolen in a recent attack on the Bitget exchange worth $387.5 million. According to Zachxbt, these are residents of China working on beha...
Stolen $387 million and complained on Discord. In response, they received a photo of Kim Jong Un
After a hacking attack on the cryptocurrency exchange Bitget, criminals are trying with varying success to launder the stolen $387.5 million. In the background, a dispute over the idea of decentralization is unfolding - THORChain refused to block the attackers' addresses and allowed them to transfer...
Transfer of Stolen Assets from Bitget to Thorchain and Conversion to Bitcoin
Bitget Requests THORChain to Block Hacker but is Rejected
OKX Star Points Out THORChain TSS + Validator Model Lacks Decentralization
Cosmos Hub Recovers 1.227 Million ATOM, Funds Stored in 4/6 Multisig Address
Tether Freezes 218,022.97 USDT from Bitget Hacker Address
Coldcard Attackers Transfer About 45% of Stolen Funds
Coldcard Wave 3 Attackers Transfer Stolen Funds for the First Time, Some Assets Converted to ETH
THORChain Soft Launch Integrates Monero, ADR31 and ADR27 Proposals Passed, v3.20 Enters Testing
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
April 2026 is not just a security crisis; it is the moment when the industry's mental model completely collapses, and it is also the moment when the protocols that can survive are distinguished from those that cannot.
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
THORChain has released its fourth update regarding the attack incident on May 15, and the proposal ADR028 has been announced, with voting for node operators now open.According to the recovery plan, the protocol will first absorb losses through its own liquidity, with the remaining portion to be shar...
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
The Echo Protocol encountered a vulnerability attack on the Monad network, where the attacker minted 1,000 eBTC (worth approximately $76.64 million). According to PeckShield's tracking, the attacker deposited 45 eBTC (about $3.45 million) into Curvance, borrowed 11.29 WBTC, and then bridged it to Et...
Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
Chainalysis posted on the X platform that before the theft of THORChain, wallets suspected to be associated with the attacker had been transferring funds through Monero, Hyperliquid, and THORChain for several weeks. The attacker-associated wallets had already deposited into Hyperliquid positions via...
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
THORChain released an update on the hacking incident on platform X. Preliminary evidence suggests that a node that recently joined the network may have been controlled by a malicious operator, who exploited the GG20 TSS vulnerability to obtain key information from vault participants, ultimately reco...
THORChain has not initiated any refund, airdrop, or compensation plans, reminding the community to be vigilant against fraud
THORChain officials stated that a large number of fake accounts and false information have appeared in the market, involving activities such as "refunds," "airdrops," and "compensations"; preliminary investigations show that user funds were not harmed in the previous security incidents, and no refun...
The Balancer attacker associated address transferred 5,609 ETH to THORChain, worth 13 million dollars
According to on-chain analysts, the Balancer attacker-associated address transferred 5,609 ETH to THORChain in the past, worth 13 million dollars.In November 2025, Balancer was stolen over 116 million dollars, with the same suspects as the Aave attack incident, both pointing to the North Korean hack...
The Balancer hacker has currently exchanged 14,300 ETH for 419.3 BTC
According to on-chain analyst Yu Jin's monitoring, the Balancer hacker has started exchanging ETH for BTC through THORChain, having already converted 14,300 ETH into 419.3 BTC (worth $32.51 million).He currently holds 7,700 ETH on the ETH chain and 419.3 BTC on the BTC chain, valued at $50.4 million...
Data: Balancer hackers today exchanged 7,000 ETH for 204.7 BTC, worth approximately 15.88 million USD
According to on-chain analyst Yu Jin's monitoring, the KelpDAO hacker exchanged all 75,700 ETH for BTC through THORChain yesterday. The hacker who stole $98 million in assets from Balancer last November also exchanged ETH for BTC through THORChain today.Today, the Balancer hacker has already exchang...
Kelp DAO Attacker Transfers $175M in Ether Following Exploit
Key Takeaways: The Kelp DAO exploiter has moved $175 million worth of Ether, part of a larger $290…
Kraken users fell victim to a social engineering attack, resulting in 8,662 ETH being stolen and transferred to HitBTC
According to on-chain analyst Yu Jin (@EmberCN), a Kraken user is suspected of falling victim to a social engineering attack, resulting in the theft of 8,662 ETH, worth approximately $18.19 million. The attacker then exchanged 878 ETH for 26.5 BTC using the cross-chain tool THORChain, and six hours ...
ZachXBT: A certain Kraken user is suspected of being a victim of social engineering fraud, resulting in a loss of 18.2 million dollars
According to ZachXBT, an unidentified Kraken user is suspected of losing approximately $18.2 million due to a social engineering scam.The address involved started transferring funds from Ethereum to Bitcoin through the SafePal wallet and THORChain about 45 minutes ago.
Shield Wall: THORChain Suffers Attack, Loses Around $1.2 Million
BlockBeats News, September 12, according to PeckShieldAlert, THORChain was attacked, losing approximately $1.2 million.
THORChain launches native support for Solana
THORChain's official Twitter announced that Solana has gone live on THORChain, currently in a progressive rollout, with the front end gradually enabling Solana support; the liquidity pool is still in the guidance phase, and it is recommended to start with small exchanges and scale up once liquidity ...
Ripple and SBI Team Up for RLUSD Stablecoin Launch in Japan by Early 2026
Latest Crypto Market Snapshot as of August 22, 2025 BTC Soars to $115,250.00 ETH Hits $4,450.75 XRP Climbs…
THORChain records $3.01 million September income, 63% from Bitget hack surge
Bitget-linked flows helped drive THORChain’s busiest stretch in more than a year after the protocol rejected selective censorship.
Bitget hack laundering generated $761,725 in fees, researcher finds
Zcash Criticized by Samson Mow After Market Cap Surpasses $22 Billion
Zcash has once again become the center of controversy in the crypto market: JAN3 CEO and Bitcoin supporter Samson Mow questioned the sustainability of the ZEC rally and stated that after the market capitalization surpassed $22 billion, the asset faces an inevitable correction. According to Mow, the ...
ZEC Liquidity Pool Launched, THORChain Trading Function Enters Next Phase
Zachxbt Identifies Five Intermediaries Involved in Cashing Out Stolen Cryptocurrency from Bitget
Zachxbt, an anonymous on-chain researcher, has revealed the aliases of five individuals he suspects of being involved in cashing out and laundering cryptocurrency stolen in a recent attack on the Bitget exchange worth $387.5 million. According to Zachxbt, these are residents of China working on beha...
Stolen $387 million and complained on Discord. In response, they received a photo of Kim Jong Un
After a hacking attack on the cryptocurrency exchange Bitget, criminals are trying with varying success to launder the stolen $387.5 million. In the background, a dispute over the idea of decentralization is unfolding - THORChain refused to block the attackers' addresses and allowed them to transfer...
...
Contents
Latest articles
04/21/2026
Latest coin listings on WEEX
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
