THORChain Hit by $10M Exploit Linked to a Malicious Node and MPC Flaw — Here's What Went Wrong

WHY IT MATTERS

Imagine a group of people each holding one piece of a combination to a vault — no single person can open it alone. That's how multi-party computation (MPC) is supposed to work in crypto: multiple nodes each hold a fragment of a private key, so no one node can steal the funds. In this case, a flaw in the specific method THORChain used (called GG20) allowed a bad actor running one of those nodes to essentially figure out the full combination and drain the vault. This matters because many crypto platforms rely on similar technology to keep funds safe, and this exploit shows that even sophisticated cryptographic systems can have hidden weaknesses. If you use decentralized exchanges or cross-chain bridges, it's a reminder that smart contract risk isn't the only danger — the underlying key management can be vulnerable too.