THORChain Co-Founder Loses $1.3M in North Korea Zoom Scam

John-Paul Thorbjornsen, co-founder of THORChain and Vultisig, lost approximately $1.3 million in a sophisticated cyberattack involving a hacked Telegram account, a deepfake Zoom call, and likely a zero-day exploit. The attackers gained access to private keys stored in his iCloud Keychain, draining an old MetaMask wallet without any transaction signing or admin prompts, while his Vultisig wallets remained secure. The incident began when a friend’s Telegram account was compromised, leading Thorbjornsen to join a Zoom call with a deepfake video that triggered a malicious script copying his iCloud documents. Blockchain security firm PeckShield confirmed the hack was personal and unrelated to THORChain’s protocol, which remains secure, and the native cryptocurrency RUNE saw no significant price impact. In response, a bounty was offered on-chain for the return of the stolen funds, promising no legal action if the assets were returned promptly. This attack reflects a growing trend of North Korean-linked hackers using deepfake social engineering tactics to target high-value crypto individuals.