THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
Prefer us on Google
THORChain has released its fourth update regarding the attack incident on May 15, and the proposal ADR028 has been announced, with voting for node operators now open.
According to the recovery plan, the protocol will first absorb losses through its own liquidity, with the remaining portion to be shared by synthetic asset holders; the specific distribution ratio of the two is still under evaluation. The protocol's own liquidity will be reduced to zero, and will be gradually replenished through system revenue. This plan will not issue or sell RUNE, nor will it dilute any holders.
On the technical side, GG20 will be temporarily retained and has completed patch upgrades. Trading will resume after the vulnerabilities are fixed and node rotation is successfully conducted, with a future release pace that is slower and more security-conscious. Innocent nodes located in the same vault as the attacker will be protected, while the attacker nodes will be fully confiscated. The recovered RUNE will be paired with the recovered assets, and any excess will be destroyed.
The protocol also offers a white hat bounty to the attacker to recover funds; if some are returned, the recovery plan will be adjusted proportionally. THORChain remains neutral and permissionless, and there will be no review of the attacker's Swap transactions after trading resumes. Node operators are currently voting on the proposal direction, and the numbers in the ADR are only indicative, with adjustments to be made through Mimir later.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
THORChain has not initiated any refund, airdrop, or compensation plans, reminding the community to be vigilant against fraud
The Balancer hacker has currently exchanged 14,300 ETH for 419.3 BTC
Data: Balancer hackers today exchanged 7,000 ETH for 204.7 BTC, worth approximately 15.88 million USD
Kelp DAO Attacker Transfers $175M in Ether Following Exploit
Key Takeaways: The Kelp DAO exploiter has moved $175 million worth of Ether, part of a larger $290…
Kraken users fell victim to a social engineering attack, resulting in 8,662 ETH being stolen and transferred to HitBTC
ZachXBT: A certain Kraken user is suspected of being a victim of social engineering fraud, resulting in a loss of 18.2 million dollars
ZachXBT: $1.2M Theft Address Likely Belongs to THORChain Founder John-Paul
Shield Wall: THORChain Suffers Attack, Loses Around $1.2 Million
Vitalik Discusses Ethereum Scaling Path, Circle Announces Partnership with Polymarket, What's the Overseas Crypto Community Talking About Today?
BTC Whale Swaps to ETH Again, Moving $38.84M in Value
Ripple and SBI Team Up for RLUSD Stablecoin Launch in Japan by Early 2026
Latest Crypto Market Snapshot as of August 22, 2025 BTC Soars to $115,250.00 ETH Hits $4,450.75 XRP Climbs…
Web3: Foreign Media Reports that the Altcoin Market in 2026 May Depend on ISM Recovery
CoinFerenceX and the best event join forces to launch “CoinFerenceX The Best Event Singapore,” the decentralized summit
BCCC Introduces JPYC for Annual Membership Fee Payments
Modernizing Financial Infrastructure for Digital Assets by 2026
Web3: Foreign Media Reports Three Changes That May Boost SHIB
"I received an airdrop, but will I have to pay taxes next year?"... How to calculate in advance with a coin calculator
Critical Patch for Decred: Those Who Don't Update Risk a Network Fork
UnitedHealth Discloses Tax Dispute with the IRS
HeyBreez Raises $2.5 Million for Global Expansion in Voice AI
Web3 Wallets in a "Season of Turmoil": Understanding the Evolution of Crypto Security's "Sword and Shield" in the AI Era
Congress Members Raise Concerns Over AI Errors in New Legislation — Politico
Unitree Robotics Stock: How to Buy 688836 After Its 629% IPO Surge
DGrid AI: Reconstructing AI Infrastructure with On-Chain Verification and Open Markets
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
