THORChain v3.20: Native XMR and ZEC, and What Actually Shipped

Disclosure: TokensFund integrates THORChain as one of four swap routes and earns an affiliate fee on swaps routed through it. Read this with that in mind — and note that we spend most of the piece on what hasn't shipped yet.

THORChain deployed v3.20 on Tuesday 25 August at around 14:00 UTC. It is the most consequential release the protocol has shipped this year, and for anyone who cares about privacy coins it is the one worth understanding — because it addresses a problem that two years of exchange delistings created and nothing else has properly solved.

The headline: native Monero and Zcash

The upgrade brings XMR and ZEC support to THORChain — swappable against BTC, ETH and stablecoins without wrapped assets and without a custodian. That distinction is the whole point. Existing routes into Monero mostly run through instant exchangers: a company takes your Bitcoin, sends you Monero, and for the duration of that swap your funds are theirs. A protocol swap has no company in the middle at all.

One precision note, because the coverage is inconsistent. A sponsored press release describes v3.20 as "unlocking" native XMR and ZEC swaps, present tense. THORChain's own announcement and the independent write-ups say Monero and Zcash "move closer to activation." Those are different claims. Our reading is that the release ships the infrastructure and activation is staged, the way BNB, Base and Solana trading is resuming progressively rather than all at once. If you are planning a privacy-coin swap on the strength of this, check that the pools are actually live before you send anything.

The rest of the release

• BNB, Base and Solana trading resumes. These chains had been halted since May. The release includes the chain-specific, solvency and security fixes that were blocking them, with trading expected to come back progressively.
• Network churn resumes — validator rotation restarting is a meaningful signal that the protocol considers itself back to normal operation.
• Protocol-Owned Liquidity mimirs go operational, and a Stable Reserve ships, adding stablecoin-to-stablecoin swaps and changing how the protocol holds its own liquidity.
• Memoless swaps expand to ERC-20s. This one is quietly important for anyone building on THORChain — more below.
• Node and TSS hardening: encryption of TSS keyshare files at rest, changes to seed-phrase handling, extended signer-cache expiry, and removal of a temporary subsystem introduced during the incident response.

The context nobody should skip

That list of security fixes is not routine housekeeping. On 15 May 2026, a newly joined node operator exploited a vulnerability in the GG20 threshold signature scheme, leaking key material during signing ceremonies and draining roughly $10.8 million from one of six Asgard vaults, with losses spread across Bitcoin, Ethereum, BNB Chain and Base. Automatic solvency detection and node coordinators halted trading, signing and churning to protect the remaining vaults. Protocol-owned liquidity absorbed the losses.

So v3.20 is two things at once: a feature release, and the end of a months-long recovery. Both facts matter. A protocol that was exploited in May and is shipping privacy-coin integration in August has demonstrated it can respond and rebuild — and has also demonstrated that its threshold-signature layer had a real vulnerability in production. Neither observation cancels the other. It is the same shape as the Coldcard entropy failure and Zcash's Orchard bug: cryptographic systems fail quietly, and the response is what you actually get to judge.

Why native privacy swaps matter more than they sound

Since the delisting waves, buying Monero has meant choosing between custodial venues that increasingly won't list it, and instant exchangers that will — but which hold your funds mid-swap and can freeze, stall or fail while doing so. We have written about what happens when those intermediaries wind down, and we removed a provider this month after a user's funds sat unresolved for days.

A protocol route removes that category of risk. Not all risk — pools can be shallow, slippage on thin liquidity is real, and as May demonstrated a protocol can be exploited. But there is no company that can decide your withdrawal needs a compliance review.

For Zcash specifically this is personal for us. ZEC's only route on TokensFund was a provider we suspended, so we removed Zcash entirely rather than keep routing users somewhere we no longer trusted. THORChain activating ZEC pools is what brings it back. We will re-add Zcash the day those pools are live and quoting — not the day a press release says they are.

A note for other integrators

The memoless-swap expansion deserves a paragraph, because the memo problem is the single biggest UX asymmetry in building on THORChain. On Bitcoin, the routing memo goes in an OP_RETURN output and any wallet can produce it. On Ethereum there is no memo field, so deposits must go through depositWithExpiry on the router contract — which means the deposit-address-and-memo pattern that works everywhere else is unfollowable from a standard wallet's send screen. We hit this directly, and fixed it on our side by detecting EVM source assets and showing the contract-call parameters instead. Every step toward memoless deposits removes that trap for someone.

A note on risk

Nothing here is financial advice. Details reflect THORChain's v3.20 announcement and contemporaneous reporting as of 26 August 2026; sources disagree on whether XMR and ZEC pools are fully live or staged for activation, and THORChain's own channels are authoritative. Do not assume a pool is active because an article says so — check, and send a test amount first. Cross-chain protocols carry smart-contract, liquidity and validator risk, as May's exploit demonstrated. We earn an affiliate fee on THORChain swaps routed through TokensFund.