THORChain Proposes Incident Recovery Plan and Node Voting for ADR028

The decentralized cross-chain liquidity protocol THORChain has released its fourth official update regarding the security breach that occurred on May 15, 2026. The project team has introduced proposal ADR028, initiating a formal voting process among node operators to determine the path forward for the network. This recovery plan focuses on stabilizing the ecosystem by utilizing internal protocol liquidity and slashing malicious actors while ensuring that no new RUNE tokens are minted or sold to cover losses.

Financial Mitigation and Asset Recovery Strategies

Under the proposed recovery framework, the protocol will initially absorb the financial impact using its own liquidity reserves. If these reserves are insufficient, the remaining losses will be proportionally shared by holders of synthetic assets, though the exact distribution ratio remains under technical evaluation. To maintain market stability, the team has explicitly stated that the plan will not involve RUNE issuance, preventing the dilution of existing token holders.

• The protocol's internal liquidity will be reduced to zero and gradually replenished via system revenue.
• Attacker nodes will be fully slashed, while innocent nodes sharing the same vault as the malicious actor will be protected.
• Recovered RUNE will be paired with retrieved assets, with any remaining surplus slated for burning to manage the circulating supply.

Technical Upgrades and Security Protocols

On the technical front, the GG20 threshold signature scheme will be temporarily retained following a critical patch upgrade. The development team intends to resume transaction processing only after the vulnerability is verified as fixed and a successful node rotation is conducted. Moving forward, the project will implement a more conservative development cycle to prioritize network security over speed.

Transactions will resume after the vulnerability is fixed and a successful node rotation is completed. In the future, a slower, more security-conscious release cadence will be adopted.

By focusing on internal revenue and slashing mechanisms rather than external financing or token inflation, THORChain aims to restore its cross-chain infrastructure while maintaining the integrity of its native token. The final implementation of these measures depends on the outcome of the ongoing node operator vote and the subsequent stability of the patched network environment.