Revisiting the $10.7M THORChain Hack with LLMs: Cryptographic Flaws Explained
banteg · x · 2026-08-12
Security researcher banteg detailed how they used LLMs (suspected to be DeepSeek 5.6 and Kimi) to assist in security research, successfully revisiting the $10.7M THORChain vault compromise.
The post breaks down how the attacker combined three implementation flaws in tss-lib:
- Malformed Paillier key admission: Accepting a 2048-bit modulus containing known small primes during keygen.
- MtA proof leak: Bob's ordinary MtA proof leaked the mask.
- Range-proof bypass: Alice's exact range-proof bypass used the degenerate commitment Z = 1.
These flaws allowed the attacker to reconstruct the vault's full ECDSA private key and sign transactions directly. The author also noted that LLMs still hit safety refusals during analysis, requiring workarounds to salvage session transcripts.
More from Safety
- A Game-Theoretic Framework for Responsible AI Release: Balancing the Capability Gap — dpaleka · 2026-08-12
- AI Governance Must Shift from 'Trust Me' to 'Verify Me' for Agents — miniapeur · 2026-08-12
- Age Verification Laws Are Quietly Building the Identity Layer for AI Agents — provenauthority · 2026-08-12
- Preventing Agent Payment Fraud: x402 Introduces MCP Endpoint Trust Scoring — MountainAssignment36 · 2026-08-12
- Open-source watermarks-remover now strips OpenAI and Gemini watermarks — jedisct1 · 2026-08-12
- Paper: Exploring the Risks of Seemingly Conscious AI — SchoeneggerPhil · 2026-08-12