THORChain lost about $10 million last month to an attacker who exploited a vulnerability in its threshold signature scheme (TSS) implementation. The exploit, detailed in a July 3 report, targeted the GG20-based TSS protocol by deliberately failing signing rounds 864 times over roughly two and a half days, gradually leaking key material from other validators. The incident underscores a growing tension in crypto security: the efficiency gains of TSS versus the on-chain auditability of traditional multisig.
How the attack worked
The attacker didn't break the cryptography in one shot. Instead, they abused the protocol's round structure — repeatedly failing signing rounds to extract partial key information. Over 864 attempts, the cumulative leakage gave them enough to reconstruct the full key. The exploit took about 60 hours, suggesting a patient, methodical approach rather than a brute-force smash-and-grab. THORChain's post-mortem didn't specify whether the vulnerability has been fully patched, but the exchange has since paused and resumed operations.
TSS vs. multisig trade-offs
The THORChain incident highlights a known weakness in TSS: protocol-level round abuse and denial-of-service risks. Multisig, by contrast, is provable on-chain — every signature is visible, and quorum enforcement happens in the script. But multisig comes with its own costs. A 2-of-3 P2SH setup eats about 296 vBytes per input; a 3-of-5 P2WSH runs ~350 vB. With Taproot and Schnorr, schemes like FROST or MuSig2 can shrink that to ~57.5 vB, cutting fees roughly 80% in higher-threshold setups. That's a big deal for high-throughput chains. But the trade-off is that TSS looks like a single signature on-chain, making it harder for auditors to verify policy without strong off-chain logs and attestations.
Wallet compromise was the costliest vector in the first half of 2026, according to CertiK's H1 review. The firm counted $1.3 billion lost across 344 incidents, with wallet-related attacks accounting for $444.5 million across just 33 cases. That's about a third of all losses from less than 10% of incidents. The THORChain exploit fits that pattern — a wallet-level vulnerability, not a smart contract bug or a bridge hack. For teams choosing between TSS and multisig, the decision often comes down to fee sensitivity versus auditability. TSS suits low-fee, high-throughput flows where the wallet acts as an externally owned account (EOA). Multisig suits conservative ops where on-chain policy visibility and simple recovery matter more than saving a few dollars per transaction.
On Ethereum, TSS can appear as a single EOA, avoiding contract execution overhead — but that also means giving up contract-level guardrails and visibility for treasuries. Privacy is cleaner with TSS because everything looks like a single key; with multisig, unless using Taproot carefully, some policy aspects can leak when spending. The THORChain case shows that the protocol-level attack surface of TSS is real, and not just theoretical. Whether the industry responds with better round-abuse protections or a shift back toward on-chain multisig for high-value wallets remains an open question.
