ZachXBT: $1.2M Theft Address Likely Belongs to THORChain Founder John-Paul
Prefer us on Google
BlockBeats News, September 12th, On-chain detective ZachXBT commented on the "A THORChain User Was Hacked for $1.2 Million" incident, suggesting that the address may belong to THORChain founder John-Paul Thorbjornsen (JP, @jpthor), whose private wallet was compromised a few days ago due to a fake conference scam. "JP is one of those who has greatly benefited from laundering money through North Korean hacker attacks/vulnerability exploits. Therefore, he suffered losses due to a North Korean-related retaliatory attack, somewhat echoing the idea of karma."
BlockBeats Note: JP's "relationship" with North Korean hackers (mainly the Lazarus Group) is not direct cooperation or personal contact but stems from the THORChain protocol's stance in the 2025 Bybit exchange hack incident. In February 2025, North Korean hackers stole around $1.4 billion worth of cryptocurrency from Bybit, making it one of the largest crypto thefts in history. These hackers then used THORChain as the primary tool to launder the stolen funds, bridging 85% of the stolen funds (approximately $1.2 billion) and converting them into other assets to evade tracking.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
THORChain has not initiated any refund, airdrop, or compensation plans, reminding the community to be vigilant against fraud
The Balancer hacker has currently exchanged 14,300 ETH for 419.3 BTC
Data: Balancer hackers today exchanged 7,000 ETH for 204.7 BTC, worth approximately 15.88 million USD
Kelp DAO Attacker Transfers $175M in Ether Following Exploit
Key Takeaways: The Kelp DAO exploiter has moved $175 million worth of Ether, part of a larger $290…
Kraken users fell victim to a social engineering attack, resulting in 8,662 ETH being stolen and transferred to HitBTC
ZachXBT: A certain Kraken user is suspected of being a victim of social engineering fraud, resulting in a loss of 18.2 million dollars
Shield Wall: THORChain Suffers Attack, Loses Around $1.2 Million
Vitalik Discusses Ethereum Scaling Path, Circle Announces Partnership with Polymarket, What's the Overseas Crypto Community Talking About Today?
BTC Whale Swaps to ETH Again, Moving $38.84M in Value
Ripple and SBI Team Up for RLUSD Stablecoin Launch in Japan by Early 2026
Latest Crypto Market Snapshot as of August 22, 2025 BTC Soars to $115,250.00 ETH Hits $4,450.75 XRP Climbs…
Why Moderna (MRNA) Stock More Than Doubled: The INTerpath-001 Cancer Vaccine Result, Explained
Moderna shares more than doubled on 19 August 2026 after Merck and Moderna said the Phase 3 INTerpath-001 trial of intismeran autogene plus KEYTRUDA met its recurrence-free survival endpoint in resected melanoma. This page explains what the result is, why the stock reacted this hard, what is still unknown, which dates come next (presentation and earnings, both unconfirmed), and what a trader can actually do on WEEX — which does not list Moderna; the nearest instrument is the XBI-USDT biotech ETF perpetual. No price targets, no forecasts.
Web3: Foreign Media Reports that the Altcoin Market in 2026 May Depend on ISM Recovery
CoinFerenceX and the best event join forces to launch “CoinFerenceX The Best Event Singapore,” the decentralized summit
BCCC Introduces JPYC for Annual Membership Fee Payments
Modernizing Financial Infrastructure for Digital Assets by 2026
Web3: Foreign Media Reports Three Changes That May Boost SHIB
"I received an airdrop, but will I have to pay taxes next year?"... How to calculate in advance with a coin calculator
Critical Patch for Decred: Those Who Don't Update Risk a Network Fork
UnitedHealth Discloses Tax Dispute with the IRS
HeyBreez Raises $2.5 Million for Global Expansion in Voice AI
Web3 Wallets in a "Season of Turmoil": Understanding the Evolution of Crypto Security's "Sword and Shield" in the AI Era
Congress Members Raise Concerns Over AI Errors in New Legislation — Politico
Unitree Robotics Stock: How to Buy 688836 After Its 629% IPO Surge
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
