THORChain releases recovery plan after attack incident, node operator voting now open

ChainCatcher reports that THORChain has released its fourth update regarding the May 15th attack. The ADR028 proposal has now been published, and validator node operator voting has begun.

According to the recovery plan, the protocol will first use its own liquidity to absorb losses, with the remaining portion to be borne by synthetic asset holders. The specific allocation ratio between the two is still under evaluation. Protocol-owned liquidity will be reduced to zero and subsequently replenished gradually through system revenue. The plan will not result in the issuance or sale of additional RUNE, nor will it dilute any holders.

On the technical side, GG20 will be temporarily retained and has already been patched and upgraded. Transactions will resume once the vulnerability is fixed and successful node rotation occurs. Going forward, the release cadence will be slower and more security-focused. Innocent nodes residing in the same vault as the attacker will be protected, while the attacker's node will be fully slashed. Recovered RUNE will be paired with reclaimed assets, and any surplus will be burned.

The protocol is also offering a white hat bounty to incentivize the attacker to return the funds. If only a portion is returned, the recovery plan will be adjusted proportionally. THORChain remains neutral and permissionless, and will not censor the attacker's Swap transactions after trading resumes. Node operators are currently voting on the proposal direction. The figures in the ADR are indicative only and will be adjusted via Mimir in the future.