Hackers accessed the wallet of THORChain founder John-Paul Thorbjornsen, extracting crypto assets worth approximately $1.3 million.
The wallet likely belongs to @jpthor who had a private wallet compromised due to a fake meeting scam a few days ago.
JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits.
So it’s a bit poetic he got rekt here by DPRK. pic.twitter.com/T57RRJ0bbf
— ZachXBT (@zachxbt) September 12, 2025
Initially, analysts suspected a breach of the protocol itself, but network representatives denied these claims.
“The incident is related to an attack on a user’s personal wallet and is not connected to THORChain,” clarified the team.
Later, on-chain investigator ZachXBT stated that the affected address was linked to Thorbjornsen and that the attack occurred during a fake online meeting. The researcher accused North Korean hackers of the breach.
“[Thorbjornsen] is one of those who gained significant financial benefit from laundering money from DPRK hacks/exploits. So it’s quite poetic that North Korea caught up with him,” added the analyst.
The THORChain founder also confirmed the rapidly spreading rumors about the breach of his personal wallet. According to a post, on September 4, he received a phishing link to a Zoom meeting on Telegram from a compromised friend’s account.
finally tracked down the source of the attack
friend’s hacked telegram account with a zoom link.
Note: this is the OFFICIAL zoom link and I joined IN THE browser. I literally saw a deep fake of my friend, but couldn’t hear anything so dropped off and tried on google meets.… https://t.co/9s2fIW4z7x pic.twitter.com/Tjx9bX8kSO
— JP (@jpthor) September 8, 2025
After Thorbjornsen clicked the link, the perpetrators used a deepfake of his friend. Within two minutes of conversation, they somehow managed to upload a malicious script to his computer and steal all data.
On September 12, THORChain began sending on-chain messages to the attackers’ addresses, requesting the return of funds for a reward.
In August, losses from hacks in the crypto industry amounted to $163 million. Analysts at PeckShield recorded about 16 major attacks.
