THORChain Exploit Breakdown

A $10 million exploit targeting a single Asgard vault on the THORChain network occurred due to a vulnerability in the GG20 Threshold Signature Scheme (TSS) code. An attacker extracted private key shares, enabling unauthorized transactions before the network’s automated solvency detection system halted operations. The development team is currently evaluating whether to patch the existing GG20 implementation or migrate to the more secure DKLS cryptography, which is widely used by institutional platforms. Potential recovery strategies include slashing the malicious node, utilizing Protocol Owned Liquidity (POL), or inflating the RUNE token to cover losses. Despite the incident, the protocol remains operational as neutral, permissionless infrastructure, with the community prioritizing a transparent, consensus-driven approach to address the insolvency and reinforce long-term security through improved node accountability and potential migration to more robust cryptographic standards.