THORChain Silently Patches Critical Bug Then Retires Bounty After Exploit Disclosure

Summary

• THORChain applied a silent patch to a critical v12 loss-of-funds bug disclosed by V12 Security on June 1 2026.
• The protocol paused its bug bounty program after high submission volume overwhelmed operations.
• Mt. Gox executed large Bitcoin transfers of over 10,000 BTC on June 2 2026 ahead of its repayment deadline.

THORChain fixed a critical vulnerability in its v12 release. V12 Security had disclosed the issue on June 1 2026. The team retired the bug bounty right before that disclosure.

Questions followed fast. Observers wondered how the protocol handled reports. V12 Security had already built trust with its Linux kernel work and called the bug loss-of-funds critical. Bitcoin felt the extra uncertainty from the Mt. Gox moves at the same time.

Context

DeFi teams use bug bounties to catch problems early. THORChain ran one to get outside eyes on its cross-chain code. Volume grew too high and the team paused new submissions.

Large Bitcoin holder moves often sway market mood. Mt. Gox shifted funds from cold storage on June 2 ahead of the October 31 2026 deadline. Those transfers lined up with the THORChain news and added separate selling pressure.

Details

V12 Security found the v12 bug after its Linux kernel research. THORChain deployed a fix without any public note. On-chain watchers spotted the change in the code repo.

The bounty pause came from sheer volume. "@hrkrshnn noted on X that Thorchain paused their bug bounty after being unable to handle the volume of submissions." New reports stopped during the window around the disclosure.

Mt. Gox moved 10,422 BTC worth about $739 million on June 2 2026. The coins left old cold wallets and mostly landed in fresh addresses. Bitcoin Magazine and on-chain analysts tracked every step.

"Thorchain paused their bug bounty after being unable to handle the volume of submissions."

, @hrkrshnn (X)

Reaction

Talk in the community centered on why the team ended the bounty. Some saw capacity issues. Others wanted clearer notice before any pause.

Traders tied the Mt. Gox transfers to quick selling that hit Bitcoin support levels. Both stories ran together and kept attention high.

Social Highlight · @v12security · Published 2026-06-01

V12 Security disclosed THORChain v12 critical bug. (link)

DeFi teams still face pressure for open processes around bounties. The June events showed how outside disclosures and big holder moves can overlap even without a direct link.

THORChain now watches its v12 deployment after the patch. Mt. Gox creditors await the next deadline on October 31 2026.