The Exploit and Immediate Response
Published 6/23/2026, 10:44:30 PM
THORChain has officially resumed full operations as of June 23, 2026, following a 39-day network halt triggered by a $10.7M exploit on May 15. The protocol is attempting to rebuild trust through a "no-dilution" recovery plan (ADR-028) that protects RUNE holders while implementing immediate security patches in version v3.19.1 [Source: https://www.google.com/search?q=THORChain+$10.7M+exploit+month-long+outage+recovery+trust+rebuilding+steps+2026]. While the network is functional and the market has shown a modest 6.8% recovery, long-term trust remains contingent on the successful transition to more robust cryptography (DKLS) and the absorption of losses without further incidents.
The Exploit and Immediate Response
The exploit targeted a vulnerability in the GG20 Threshold Signature Scheme (TSS), which allowed a malicious node operator to reconstruct a vault's private key. This resulted in the drainage of approximately $10.7M in ETH, BTC, and BNB [Source: https://www.google.com/search?q=THORChain+$10.7M+exploit+month-long+outage+recovery+trust+rebuilding+steps+2026].
- Containment: The network was paused within two hours of the anomaly through automated solvency checks and manual coordination.
- Scope of Loss: Only one of six Asgard vaults was affected. Crucially, user funds and liquidity provider (LP) positions were not drained; the loss was confined to protocol-level vault assets [Source: https://www.google.com/search?q=THORChain+$10.7M+exploit+month-long+outage+recovery+trust+rebuilding+steps+2026].
- Investigation: THORChain's incident report indicates the root cause analysis is ongoing, though early updates suggest the attack vector was not related to previously known GG20 exploits [Note: not independently confirmed].
Trust-Rebuilding Strategy: ADR-028
To recapitalize the system without penalizing the broader community, THORChain adopted the ADR-028 governance proposal:
| Feature | Implementation Detail |
|---|---|
| Loss Absorption | Uses Protocol-Owned Liquidity (POL) to cover the $10.7M deficit. |
| Synth Haircut | Any shortfall remaining after POL exhaustion is distributed among synthetic asset holders. |
| No Dilution | The foundation pledged not to mint or sell new RUNE, avoiding inflationary pressure on investors. |
| Security Patches | v3.19.1 introduced vault quarantine features and mandatory keyshare verification [Source: https://www.google.com/search?q=THORChain+$10.7M+exploit+month-long+outage+recovery+trust+rebuilding+steps+2026]. |
Current Market Status
As of the restart on June 23, 2026, the network has resumed swaps, churning, and liquidity actions.
- RUNE Price: $0.4177 (+6.8% in 24 hours) [Source: https://api.coingecko.com/api/v3/coins/thorchain].
- Market Cap: $141.63M [Source: https://api.coingecko.com/api/v3/coins/thorchain].
- Sentiment: The rapid containment and transparent recovery plan have mitigated some criticism, though the month-long outage remains a point of contention for users seeking high uptime.
Future Outlook and Risks
To regain momentum, THORChain has announced the imminent launch of Monero (XMR) and Zcash (ZEC) swaps, which are expected within 1–2 weeks of the restart [Source: https://www.google.com/search?q=THORChain+$10.7M+exploit+month-long+outage+recovery+trust+rebuilding+steps+2026].
However, a significant technical debt remains: the transition to DKLS cryptography, which is considered more secure than the current GG20 implementation, has been deferred until the network achieves sustained stability [Note: not independently confirmed]. Until this transition is complete, the protocol may still face scrutiny regarding its underlying threshold signature architecture.
Would you like a technical deep dive into the v3.19.1 security features or a risk metric analysis of RUNE's current volatility?