Asgard

Source

Monero

THORChain

Zcash

<p>A single Asgard vault drain set <a href="https://cryptodaily.co.uk/2026/06/coinbase-tokenized-shares-defi-dividends" rel="noopener noreferrer nofollow">THORChain</a> back on its heels in mid-May. Roughly $10.7 million vanished, <a href="https://cryptodaily.co.uk/2026/06/kraken-us-perps-vs-onchain" rel="noopener noreferrer nofollow">trading paused</a>, and the community braced for tough decisions.</p>
<p>Now a path to restart is live. Governance ratified ADR028, developers shipped v3.19 migrations, and leadership has guided the community toward a controlled reopening. The question is whether that’s enough for RUNE to rebuild trust.</p>
<p>Here’s what was decided, who covers the loss, what changes at the protocol level, and how to assess the reopening.</p>
<p>THORChain operates one of the few live cross-chain automated market maker networks, routing native assets between L1s via vaults managed by rotating validator sets. That power comes with attack surface. In May 2026, a single Asgard vault was drained, triggering emergency procedures and a network-wide pause while teams triaged and planned a restart.</p>
<blockquote>
 <p>The credibility of THORChain’s restart turns on two things: how losses are socialized, and whether hardening changes reduce repeat risk without breaking core features.</p>
</blockquote>
<p>The team’s “Exploit Report #1” confirmed the amount and immediate patch path, and governance converged on ADR028—a staged restart funded by Protocol-Owned Liquidity (POL) rather than new token issuance. Timelines point to trading resumption as early as mid-June, contingent on final checks and node coordination.</p>
<h2 id="what-actually-broke-unpicking-the-asgard-vault-drain">What Actually Broke: Unpicking the Asgard Vault Drain</h2>
<h3 id="single-vault-exposure-not-global-collapse">Single-vault exposure, not global collapse</h3>
<p>THORChain’s initial incident write-up stated that an unauthorized drain of approximately $10.7 million occurred from a single Asgard vault on May 15, 2026, with details published May 20 as “Exploit Report #1.” The team pointed to patch v3.18.1 as the immediate containment step and identified ADR-028 as the longer-term recovery mechanism (<a href="https://blog.thorchain.org/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">THORChain (blog) — Exploit Report #1</a>).</p>
<h3 id="initial-containment-and-posture">Initial containment and posture</h3>
<p>Following the vault drain, the protocol moved to pause risk-exposed functions and coordinate a code and process review across nodes. The aim was to isolate the incident, prevent contagion to other vaults, and prepare a migration plan aligning with governance decisions. The team emphasized a no-rush posture to avoid compounding errors while restoring the network safely.</p>
<h2 id="adr028-and-the-no-mint-restart-plan">ADR028 and the No‑Mint Restart Plan</h2>
<h3 id="using-pol-instead-of-dilution">Using POL instead of dilution</h3>
<p>On May 27, node operators approved ADR028, authorizing a staged restart that covers the loss using Protocol-Owned Liquidity and explicitly avoids minting or selling new RUNE. The proposal also opened a hacker-bounty window to incentivize return of funds (<a href="https://www.kucoin.com/news/flash/thorchain-nodes-approve-adr028-clear-path-for-controlled-restart-without-minting-rune" rel="noopener noreferrer nofollow">KuCoin (news) — ADR028 approval</a>).</p>
<p>The “no-mint” commitment matters for tokenholders. It removes one common post-hack reflex—inflate supply to recapitalize—and shifts the cost to the protocol’s balance sheet, with potential knock-on effects for liquidity depth and yield.</p>
<h3 id="how-the-restart-unfolds">How the restart unfolds</h3>
<p>Based on the team’s updates, the sequence is designed to ensure safety, then functionality, then breadth:</p>
<ol>
 <li>Lock in the loss-accounting methodology via ADR028 and implement it in migrations.</li>
 <li>Ship and adopt releases (v3.18.1 for immediate containment; v3.19 for full restart with store migrations).</li>
 <li>Coordinate node upgrades and verify-key fixes to ensure vault control is consistent.</li>
 <li>Resume trading cautiously, monitor pools and vault behavior, and adjust parameters if needed.</li>
 <li>Re-open chain integrations in stages, prioritizing those already audited and queued.</li>
 <li>Maintain the bounty window to potentially reclaim funds and offset POL usage.</li>
</ol>
<p>This prioritization tries to avoid systemic risk while restoring core UX and liquidity links.</p>
<h2 id="v3-19-migrations-and-hardening-work">v3.19 Migrations and Hardening Work</h2>
<h3 id="from-plan-to-implementation">From plan to implementation</h3>
<p>In a May 29 “Path to Restart” update, THORChain identified v3.19 as the restart release, containing store migrations to implement ADR028’s loss methodology. The post noted developers resolved a roughly $700,000 shortfall in the migration logic—“the $700k gap … ironed out by Codehans”—before moving forward (<a href="https://blog.thorchain.org/thorchain-path-to-restart-v3-19-soda-labs-and-hardening-the-vaults" rel="noopener noreferrer nofollow">THORChain (blog) — 'Path to Restart' (May 29, 2026)</a>).</p>
<h3 id="operational-fixes-and-expected-resumption">Operational fixes and expected resumption</h3>
<p>By June 11, nodes had adopted v3.19, with v3.19.1 rolled out to finish verify-key and Gaia fixes. Leadership indicated trading could resume within the following week—with Chad Barraford saying he “leaned Tuesday or Wednesday”—subject to final validation. The same update queued Zcash within “a week or two,” and targeted Monero integration for July 1–15 (<a href="https://blog.thorchain.org/thorchain-eyes-trading-by-midweek-chad-maps-the-final-restart-steps-with-zcash-and-monero-queued" rel="noopener noreferrer nofollow">THORChain (blog) — 'Eyes Trading by Midweek' (June 11, 2026)</a>).</p>
<p>The cadence underscores a safety-first reopening, adding integrations only after vault and key-handling fixes settle.</p>
<h2 id="restart-timeline-and-what-to-watch">Restart Timeline and What to Watch</h2>
<h3 id="key-dates-and-decisions">Key dates and decisions</h3>
<p>Date (2026) Milestone Notes / Source May 15 Asgard vault drained (~$10.7M) Incident date cited in the exploit report; single-vault impact (<a href="https://blog.thorchain.org/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">THORChain blog</a>) May 20 Exploit Report #1 Confirms loss amount; outlines v3.18.1 patch and ADR-028 recovery path (<a href="https://blog.thorchain.org/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">THORChain blog</a>) May 27 ADR028 approved Staged restart; use POL; avoid minting RUNE; bounty window activated (<a href="https://www.kucoin.com/news/flash/thorchain-nodes-approve-adr028-clear-path-for-controlled-restart-without-minting-rune" rel="noopener noreferrer nofollow">KuCoin</a>) May 29 Path to Restart (v3.19) Migrations implement ADR028; $700k logic gap resolved by Codehans (<a href="https://blog.thorchain.org/thorchain-path-to-restart-v3-19-soda-labs-and-hardening-the-vaults" rel="noopener noreferrer nofollow">THORChain blog</a>) June 11 Nodes adopt v3.19, v3.19.1 in flight Verify-key/Gaia fixes; trading expected midweek; Zcash soon; Monero targeted early–mid July (<a href="https://blog.thorchain.org/thorchain-eyes-trading-by-midweek-chad-maps-the-final-restart-steps-with-zcash-and-monero-queued" rel="noopener noreferrer nofollow">THORChain blog</a>)</p>
<h3 id="signals-that-trust-is-returning">Signals that trust is returning</h3>
<p>In the first weeks after trading resumes, focus on a handful of operational and market indicators, not price alone:</p>
<ul>
 <li>Pool depth and churn stability across major pairs versus pre-pause levels.</li>
 <li>Spread and slippage on cross-chain swaps during peak hours.</li>
 <li>Node participation and bond health after upgrades complete.</li>
 <li>Incidents or anomalies reported in vault operations, especially during chain rotations.</li>
 <li>Rate of third-party integrations (wallets, aggregators) re-enabling THORChain routing.</li>
</ul>
<h2 id="who-pays-and-what-it-means-for-rune">Who Pays and What It Means for RUNE</h2>
<h3 id="socializing-losses-without-minting">Socializing losses without minting</h3>
<p>The ADR028 decision to use POL rather than minting or selling new RUNE sidesteps immediate dilution risk. The cost instead lands on the protocol’s balance sheet, potentially reducing owned liquidity and, in turn, affecting pool depth. Shallower pools can raise slippage and temporarily compress volume until market-makers and LPs step back in.</p>
<h3 id="implications-for-lps-and-node-operators">Implications for LPs and node operators</h3>
<p>Liquidity providers will weigh yield versus perceived security. If POL absorbs losses, LPs might not face direct haircutting tied to the exploit, but a thinner protocol-owned base could change rewards dynamics. Node operators must complete upgrades, verify key assignments, and monitor vault behavior closely; the professionalism of this cohort is a leading indicator for network safety.</p>
<h3 id="rune-s-supply-narrative">RUNE’s supply narrative</h3>
<p>Not minting RUNE helps maintain the token’s credibility. But no-mint does not mean no impact: the opportunity cost is borne by protocol capital that could otherwise seed growth or incentives. Over time, the protocol can replenish POL through fees and careful treasury management, assuming volumes return.</p>
<h3 id="market-structure-and-liquidity-recovery">Market structure and liquidity recovery</h3>
<p>When trading resumes, arbitrageurs will likely test edges across chains and centralized venues. If vault handling and settlement latency improve under v3.19.x, spreads should normalize. Watch for conservative parameter sets—like swap limits and throttles—initially constraining throughput as a safety measure, then loosening as confidence builds.</p>
<p>Automatic Response Table (timestamps, Mimir keys and block numbers) showing the chain-level halts the solvency checker triggered — demonstrates how THORChain automatically contained the incident. — Source: <a href="https://blog.thorchain.org/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">THORChain (Exploit Report #1)</a></p>
<h2 id="operational-outlook-integrations-and-guardrails">Operational Outlook: Integrations and Guardrails</h2>
<h3 id="privacy-chains-on-deck">Privacy chains on deck</h3>
<p>Re-enabling Zcash within “a week or two” and targeting Monero for July 1–15 signals confidence in vault operations under the updated releases. These integrations are complex—especially around key management and fee estimation—so their safe activation is a milestone for the restart’s maturity (<a href="https://blog.thorchain.org/thorchain-eyes-trading-by-midweek-chad-maps-the-final-restart-steps-with-zcash-and-monero-queued" rel="noopener noreferrer nofollow">THORChain blog</a>).</p>
<h3 id="process-hardening-beyond-code">Process hardening beyond code</h3>
<p>Beyond patches, expect more conservative operational practices: stricter key verification flows, phased chain rollouts, and potentially tighter monitoring around vault transitions. Post-incident bounties and disclosure channels can shorten the feedback loop on vulnerabilities and encourage whitehat cooperation.</p>
<h2 id="risks-what-could-go-wrong">Risks &amp; What Could Go Wrong</h2>
<ul>
 <li>Residual vulnerability: The exploit vector could have adjacent variants that evade current mitigations.</li>
 <li>Liquidity shock: Using POL to cover losses may thin protocol-owned depth, increasing slippage during reopening.</li>
 <li>Governance friction: If parameters stay restrictive for too long, LPs and traders may shift volume elsewhere.</li>
 <li>Integration risk: Re-enabling Zcash/Monero introduces fresh surface area in key handling and fee logic.</li>
 <li>Bounty uncertainty: Hacker-bounty outcomes are unpredictable and may not meaningfully offset losses.</li>
 <li>Node coordination: Any lag or misconfiguration in verify-key steps could disrupt vault control during churn.</li>
 <li>Reputational overhang: Even with a smooth restart, some venues or wallets might delay reactivation, dampening volume.</li>
</ul>
<blockquote>
 <p>No patch is a panacea; the next 30–60 days hinge on disciplined ops, parameter tuning, and transparent incident reporting.</p>
</blockquote>
<p>For ongoing coverage and context across DeFi security incidents and restarts, Crypto Daily tracks governance votes, on-chain metrics, and developer updates in real time. You can follow our rolling reports and explainers at <a href="https://cryptodaily.co.uk" rel="noopener noreferrer nofollow">Crypto Daily</a>.</p>
<h2 id="frequently-asked-questions">Frequently Asked Questions</h2>
<h3 id="what-happened-in-thorchain-s-10-7m-incident">What happened in THORChain’s $10.7M incident?</h3>
<p>An unauthorized drain hit a single Asgard vault around May 15, 2026. THORChain’s May 20 Exploit Report #1 confirmed the approximate $10.7M loss and outlined v3.18.1 as an immediate patch with ADR-028 as the recovery framework (<a href="https://blog.thorchain.org/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">THORChain blog</a>).</p>
<h3 id="what-is-adr028-and-why-does-it-matter">What is ADR028 and why does it matter?</h3>
<p>ADR028 is the governance-approved roadmap for a staged restart. It socializes losses through Protocol-Owned Liquidity instead of minting or selling new RUNE, and it opened a bounty window to encourage fund return. Nodes approved ADR028 on May 27, 2026 (<a href="https://www.kucoin.com/news/flash/thorchain-nodes-approve-adr028-clear-path-for-controlled-restart-without-minting-rune" rel="noopener noreferrer nofollow">KuCoin</a>).</p>
<h3 id="will-thorchain-mint-new-rune-to-cover-the-loss">Will THORChain mint new RUNE to cover the loss?</h3>
<p>No. ADR028 explicitly avoids minting or selling new RUNE. Losses are covered by the protocol’s own liquidity, which protects holders from direct dilution but may temporarily reduce pool depth.</p>
<h3 id="when-could-trading-resume">When could trading resume?</h3>
<p>As of June 11, 2026, nodes had adopted v3.19 and v3.19.1 was being distributed for verify-key and Gaia fixes. Leadership said they expected trading to resume within the following week, subject to final checks (<a href="https://blog.thorchain.org/thorchain-eyes-trading-by-midweek-chad-maps-the-final-restart-steps-with-zcash-and-monero-queued" rel="noopener noreferrer nofollow">THORChain blog</a>). Timelines can slip if safety tests require it.</p>
<h3 id="how-are-liquidity-providers-affected">How are liquidity providers affected?</h3>
<p>Because POL is used to socialize losses, LPs are shielded from a direct exploit-linked haircut under ADR028. However, thinner protocol-owned depth can impact slippage and yields until liquidity rebuilds and volumes normalize.</p>
<h3 id="what-about-zcash-and-monero-integrations">What about Zcash and Monero integrations?</h3>
<p>The June 11 update queued Zcash within “a week or two” of trading resumption and targeted Monero for July 1–15, contingent on successful vault operations and key management under v3.19.x (<a href="https://blog.thorchain.org/thorchain-eyes-trading-by-midweek-chad-maps-the-final-restart-steps-with-zcash-and-monero-queued" rel="noopener noreferrer nofollow">THORChain blog</a>).</p>
<h3 id="what-should-users-and-traders-watch-post-restart">What should users and traders watch post-restart?</h3>
<p>Monitor pool depth, swap slippage, node participation, and any reported vault anomalies. Early reopening may include conservative limits; those can relax as stability is demonstrated.</p>
<p>Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.</p>

THORChain’s Restart Plan: Can RUNE Recover Trust After the $10.7M Hack?

Table of Contents

Crypto Daily™

Other articles published on Jun 18, 2026

Join our free newsletter for daily crypto updates!