THORChain: Network Suspended Due to Security Incident; Suspected Single Malicious Node Exploited GG20 TSS Vulnerability to Steal Funds

Odaily Planet Daily News THORChain posted on platform X that its developers issued an incident update on Discord. Current evidence points to a newly joined node thor16uc...cn84q being related to the attack, operated by a single malicious actor. The main speculation is that the attacker exploited a vulnerability in the GG20 TSS implementation, causing the sensitive key material of vault participants to leak over time, eventually reconstructing the vault's private key and executing unauthorized withdrawal transactions.

Regarding network status, after multiple node operators executed the make pause command, the network has been suspended. RUNE transfers and on-chain observations may resume within approximately 12 hours, but transactions, LP operations, signatures, and other sensitive operations remain paused.

Discussions on the recovery plan include slashing the margin of the affected node, covering losses with the Protocol Owned Liquidity (POL), or other community-driven solutions. THORSec and Outrider Analytics are conducting ongoing investigations, and the Treasury is collecting forensic data and coordinating with relevant law enforcement agencies. Full functional recovery is expected to take several days or longer.