THORChain Releases Update on May 15 Attack Recovery Plan

THORChain has released its fourth update regarding the attack on May 15, with proposal ADR028 now available and node operator voting underway. According to ChainCatcher, the recovery plan involves initially absorbing losses through protocol-owned liquidity, with the remaining losses shared by synthetic asset holders. The exact distribution ratio is still under evaluation. Protocol-owned liquidity will be reduced to zero and gradually replenished through system revenue. The plan does not involve minting or selling RUNE, nor will it dilute any holders. On the technical side, GG20 will be temporarily retained and has undergone a patch upgrade. Trading will resume once the vulnerability is fixed and node rotation is successfully completed, with future releases adopting a slower and more security-conscious pace. Innocent nodes in the same vault as the attacker will be protected, while the attacker's node will be fully penalized. Recovered RUNE will be paired with recovered assets, with any excess being destroyed. The protocol has also offered a white-hat bounty to the attacker for fund recovery, with the recovery plan subject to proportional rollback if partial returns are made. THORChain remains neutral and permissionless, and will not censor the attacker's swap transactions once trading resumes. Node operators are currently voting on the proposal's direction, with numbers in the ADR being indicative and subject to adjustment through Mimir.