THORChain Proposes Recovery Plan for the May 15 Attack; Node Operators Begin Voting

ChainCatcher report: THORChain has released its fourth update regarding the May 15 attack. Proposal ADR028 has now been published, and voting by node operators has commenced. Under the recovery plan, the protocol will first absorb losses using its own liquidity, with any remaining losses shared by synthetic asset holders—the exact allocation ratio between the two is still under evaluation. Protocol-owned liquidity will be reduced to zero and gradually replenished through system revenues. This plan does not involve minting or selling additional RUNE, nor will it dilute any holders. On the technical side, GG20 has been temporarily retained and patched; trading will resume after the vulnerability is fixed and a successful node rotation is completed, with future releases adopting a slower, more security-conscious cadence. Innocent nodes located in the same vault as the attacker will be protected, while the attacker’s nodes will be fully slashed; recovered RUNE will be paired with recovered assets, with any excess burned. The protocol has also offered a bug bounty to the attacker to recover funds, and if partial restitution is made, the recovery plan will be proportionally adjusted. THORChain remains neutral and permissionless; once trading resumes, swaps by the attacker will not be censored. Node operators are currently voting on the direction of the proposal; the numbers in ADR are indicative only and will be adjusted via Mimir in the future.