THORChain Approves ADR028: Network Restart Post-Exploit
THORChain nodes have approved ADR028, advancing the protocol’s recovery from the May 15 exploit that drained approximately $10.7 million from one of five vaults. The incident, which used a GG20 Threshold Signature Scheme vulnerability, was triggered by a newly churned node operator who entered the network two days prior. The remaining four vaults were unaffected. Now, as the community awaits a staged restart, developers are preparing v3.19.0 testing while the hacker bounty window is active.
Broader crypto markets show Bitcoin (BTC) at $75,857, Ethereum (ETH) at $2,087.84, XRP at $1.33, and Solana (SOL) at $83.99—a neutral backdrop for THORChain‘s recovery timeline. RUNE, which dropped sharply after the exploit alert, remains under pressure. Hyperliquid (HYPE) trades at $62.09, reflecting mixed sentiment in DeFi tokens.
ADR028 Recovery Mechanics: No Dilution for RUNE Holders
The approved ADR028 plan avoids minting new RUNE, selling RUNE, or diluting holders. Instead, it uses protocol-owned liquidity first, with any remaining shortfall spread across synth holders. The team confirmed that the hacker bounty is now active, giving the attacker a window to return funds. Any recovered assets will be paired with recovered RUNE from the affected vault, and surplus RUNE will be burned. The attacker’s node faces full slashing, while innocent nodes in the same vault are protected.
Technical Path to Restart
Nodes have already upgraded to v3.18.1, which also restores Rujira Network’s credit management. The next step is cutting v3.19.0, expected to move to stagenet by the end of the following day—though no exact timeline is confirmed. Once mainnet-ready, node operators must upgrade quickly to ensure a safe restart. Meanwhile, the tss-lib has been moved to closed source for a few weeks to allow THORSec to complete a full security audit without exposing remediation work.
Market Implications: DeFi Sector Under Scrutiny
The exploit initially caused losses estimated between $7.4 million and over $10 million across Bitcoin, Ethereum, BSC, and Base, as flagged by blockchain investigator ZachXBT. THORChain’s automatic solvency checks detected the imbalance within minutes, and manual emergency pauses stopped trading within about two hours. This incident adds to mounting pressure on DeFi protocols to harden security post-GG20 vulnerabilities, potentially affecting investor confidence in cross-chain liquidity tokens like RUNE.
Broader Crypto Context
With BTC at $75,857 and ETH at $2,087.84, macro trends remain range-bound. The THORChain recovery, if successful without diluting RUNE, could restore trust. However, the closed-source audit period marks a temporary shift from the protocol’s open-source ethos. Traders should watch for v3.19.0 adoption and final loss coverage figures—expected to be shared later—as key catalysts for RUNE price action.
Market Outlook: Neutral. The recovery plan is non-dilutive but execution risk remains until mainnet restart and audit completion. RUNE may trade sideways until clarity emerges.
