THORChain is real, and it is important: it is the largest venue for swapping native Bitcoin without an intermediary, it has run since 2021, and its design, native assets in threshold-signature vaults with RUNE as the settlement asset, is studied and copied. It is also anonymous, unregulated, and has a record that an honest page has to list. Two exploits in July 2021 during its Chaosnet phase cost around $8 million each. A lending and savers freeze in January 2025 left roughly $200 million in liabilities to be restructured through a new token. And on May 15, 2026 a node operator who had joined two days earlier exploited the signing scheme during a vault rotation, drained about $10.7 million, and trading stopped for five weeks.
Then there is what it is used for. After the $1.5 billion Bybit hack in February 2025, the Lazarus Group routed hundreds of millions of dollars of stolen Ether through THORChain within days, swap volume hit records, and an attempt by three nodes to halt Ethereum trading was reversed; a core developer resigned in protest on February 27. The protocol worked exactly as designed, which is the point its defenders make and the point regulators make too. We found no enforcement action against THORChain, and there is no entity to bring one against.
The honest read is that THORChain is legitimate technology with a real history of breaking and a real history of being abused, and that its lack of a company is both the feature and the risk. If your question is whether it is safe to buy Bitcoin, Ethereum or USDC and hold it, that is a question for a licensed U.S. money services business with an address and a phone number, and THORChain is not one.