THORChain · Vulnerability Disclosure

Thorchain Vulnerability Disclosure

Vulnerability disclosure

THORChain publishes a vulnerability disclosure policy for reporting security issues. A dedicated security contact is published.

CompanyCrypto Web3BlockchainDeFiCross-chainLiquidityDecentralized ExchangeCosmosWeb3 Infrastructure
Program:

Disclosure Policy

Policy
https://gitlab.com/thorchain/thornode/-/blob/develop/bugbounty.md

Security Contact

Contact
security@thorchain.org
Contact
security@sodalabs.xyz

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://gitlab.com/thorchain/thornode/-/blob/develop/bugbounty.md
probe: false
policy:
  - https://gitlab.com/thorchain/thornode/-/blob/develop/bugbounty.md
contact:
  - security@thorchain.org
  - security@sodalabs.xyz
bug_bounty:
  status: retired
  retired: '2026-03'
  note: >-
    THORChain's paid bug bounty program was retired as of March 2026, but
    responsible disclosure of security issues is still requested and
    acknowledged. Reporters are encouraged to encrypt submissions with age or
    GPG (keys published in bugbounty.md).
audits:
  url: https://github.com/thorchain/Resources/tree/master/Audits
  note: THORChain publishes its third-party security audits in the thorchain/Resources GitHub repo.
evidence:
  - source: https://gitlab.com/thorchain/thornode/-/blob/develop/bugbounty.md
    kind: disclosure-policy
    keywords: [responsible disclosure, security@thorchain.org, bug bounty, GPG]
  - source: security/thorchain-bugbounty.md
    kind: saved-verbatim