Odaily Planet Daily report: THORChain posted on X that its developers have released an incident update on Discord. Current evidence points to a newly joined network node, thor16uc...cn84q, being associated with the attack, operated by a single malicious actor. The primary hypothesis is that the attacker exploited a vulnerability in the GG20 TSS implementation, causing the gradual leakage of sensitive key material from vault participants, ultimately enabling reconstruction of the vault’s private key and execution of unauthorized withdrawal transactions.
Regarding network status, the network has been paused after multiple node operators executed "make pause." RUNE transfers and on-chain observations are expected to resume within approximately 12 hours, but transactions, LP operations, signatures, and other sensitive actions remain paused.
The recovery plan under discussion includes slashing the collateral of affected nodes, absorbing losses through Protocol-Owned Liquidity (POL), or other community-driven solutions. THORSec and Outrider Analytics are continuing their investigation, while the Treasury is gathering forensic data and coordinating with relevant law enforcement agencies. Full functionality restoration is expected to take several days or longer.