Drift

ZachXBT

THORChain

Read

Threshold

<p><strong>THORChain node operators are voting on ADR028, a recovery plan that would restart the network after a $10.7 million exploit without minting new RUNE.</strong></p>
<div id="cn-block-summary-block_61e5e8cdba4bb55b4161c27af8b86c86" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>THORChain’s ADR028 plan would use protocol-owned liquidity first before sharing remaining losses with synth holders.</li>
   <li>The proposal avoids new RUNE minting, token sales, or holder dilution while node operators vote on recovery.</li>
   <li>Recent DeFi exploits add pressure on THORChain to restart safely after patching its GG20 vulnerability.</li>
  </ul>
 </div>
</div>
<p>THORChain said node operators are now voting on ADR028 after the May 15 incident. The proposal sets the direction for recovery, while exact figures remain open to later changes through Mimir governance.</p>
<p>The official exploit <a href="https://thorchain.org/blog/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">report</a> said the attacker drained about $10.7 million from one of five vaults. THORChain said the attacker was a newly churned node operator who exploited a GG20 Threshold Signature Scheme vulnerability. The other four vaults were not affected.</p>
<p>You might also like: <a href="https://crypto.news/sec-tokenized-stock-plan-raises-exchange-revenue-fears/" rel="noopener noreferrer nofollow"> SEC tokenized stock plan raises exchange revenue fears </a></p>
<h2 class="wp-block-heading" id="strong-recovery-plan-avoids-new-rune-strong"><strong>Recovery plan avoids new RUNE</strong></h2>
<p>Under ADR028, protocol-owned liquidity would absorb the loss first. Any remaining shortfall would then be shared across synth holders. THORChain said the split is still being reviewed and will be adjusted later.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>THORChain Incident Update #4<br>Following the events of May 15th, the community has been hard at work defining a path forward. ADR028 is now published and a vote is open for Node Operators.<br><br>🔹 The Recovery Plan 🔹<br>The protocol will absorb the loss first through Protocol-Owned…</p>— THORChain (@THORChain) <a href="https://twitter.com/THORChain/status/2057705889784623396?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 22, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The proposal says no new RUNE will be minted, no RUNE will be sold, and holders will not be diluted. Protocol-owned liquidity would be reduced to zero, with part of future system income redirected to rebuild it over time.</p>
<p>Moreover, THORChain said GG20 will stay in place for now, but it must be patched and upgraded before trading resumes. The network will also need a successful churn before normal activity returns.</p>
<p>The exploit report said automatic solvency checks detected the vault imbalance within minutes. Node operators then used manual pauses and Mimir votes to halt trading, signing, chain observation, and churning within about two hours of the community alert.</p>
<h2 class="wp-block-heading" id="strong-recent-defi-exploits-add-pressure-strong"><strong>Recent DeFi exploits add pressure</strong></h2>
<p>The THORChain vote comes after earlier reports said the protocol halted trading when ZachXBT <a href="https://crypto.news/zachxbt-warns-thorchain-losses-may-top-10m-after-halt/" rel="noopener noreferrer nofollow">warned</a> that losses could top $10 million across Bitcoin, Ethereum, BSC, and Base. Related coverage noted that RUNE fell after the alert as users waited for clearer details from protocol operators.</p>
<p>The incident also follows a busy period for crypto exploits. Recent reports <a href="https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/" rel="noopener noreferrer nofollow">said</a> the Verus Ethereum bridge lost more than $11.5 million after attackers used a forged cross-chain transfer message. Security firms linked that exploit to missing validation checks in the bridge process.</p>
<p>April also <a href="https://crypto.news/crypto-hacks-top-600m-in-april-as-market-prices-in-security-tax/" rel="noopener noreferrer nofollow">showed</a> how heavy the pressure on DeFi security has become. Crypto protocols lost more than $606 million in the first 18 days of April, led by the $292 million KelpDAO breach and the $285 million Drift Protocol exploit.</p>
<p>TRM Labs also <a href="https://crypto.news/trm-labs-north-korea-linked-hackers-drive-76-of-2026-crypto-thefts/" rel="noopener noreferrer nofollow">reported</a> that North Korea-linked actors drove about 76% of global crypto hack losses in the first four months of 2026. The firm put those losses at about $577 million through April.</p>
<h2 class="wp-block-heading" id="strong-attacker-faces-slashing-and-bounty-offer-strong"><strong>Attacker faces slashing and bounty offer</strong></h2>
<p>ADR028 proposes full slashing for the attacker’s node. THORChain said innocent nodes assigned to the same vault would be protected. Recovered RUNE would be paired with any assets recovered from the affected vault, while surplus RUNE would be burned.</p>
<p>The proposal also offers the attacker a bounty to return the funds. If funds are returned in part, the recovery plan would roll back by the same share. THORChain also said the protocol will remain neutral and permissionless, meaning the attacker’s swaps will not be censored once trading resumes.</p>
<p>The vote now gives node operators a path to approve the recovery direction. It does not finalize every number. The main test is whether THORChain can restart safely, absorb losses without new RUNE, and restore confidence after another high-profile DeFi exploit.</p>
<p>Read more: <a href="https://crypto.news/galaxy-and-bitgo-face-off-over-failed-1-2b-deal/" rel="noopener noreferrer nofollow"> Galaxy and BitGo face off over failed $1.2B deal </a></p>

THORChain offers hacker bounty as restart vote opens

Table of Contents

crypto.news

Other articles published on May 22, 2026

Join our free newsletter for daily crypto updates!