THORChain Co-Founder Loses $1.3M in North Korean Deepfake Zoom Hack

John-Paul Thorbjornsen, co-founder of cross-chain protocol THORChain, confirmed he lost approximately $1.3 million in a sophisticated North Korean hacking attack that occurred via a deepfake Zoom call. The incident took place several days ago but was publicly acknowledged on September 12, 2025.

The attack began when hackers compromised a friend's Telegram account to lure Thorbjornsen into joining an official Zoom link. During the two-minute call, he encountered a convincing deepfake video of his friend but heard no audio. Unknowingly, this triggered a malicious script that copied his iCloud documents folder to a temporary directory, allowing access to sensitive data without raising immediate alarms.

Thorbjornsen explained that the attackers accessed an old MetaMask wallet linked to an inactive Chrome user profile, whose private keys were stored in his iCloud Keychain. His multisig Vultisig wallets remained untouched. He believes the hackers exploited a zero-day vulnerability to penetrate his system without requiring admin access or triggering warnings.

THORChain was quick to clarify that company funds were completely secure and unaffected by the incident. In recovery efforts, THORSwap has offered a bounty for the return of the stolen assets, with a blockchain message promising no legal action if funds are returned within 72 hours.

The incident drew ironic commentary from blockchain investigator ZachXBT, who noted that THORChain had previously processed between $5-10 million in fees from laundering funds from North Korea's $1.5 billion Bybit hack - the DPRK's most successful crypto heist. Thorbjornsen had previously defended North Korea's right to conduct such operations, stating in an interview: "[North Korea] has the right to be sovereign. If they exploit security loopholes... that is their effort. They're not inherently doing anything wrong in my opinion."

This attack is part of a broader trend where North Korean-linked groups have stolen over $2 billion in 2025 alone, using increasingly sophisticated methods including deepfakes, social engineering, and advanced malware targeting crypto executives.