Further updates will follow. Appreciation is expressed for the patience and support

tss-lib has been temporarily moved to closed source for the next few weeks to allow THORSec to complete a full security audit without exposing ongoing remediation work. The repository will be reopened

The protocol will cover the remaining loss using POL; figures are being defined and will be shared in a follow-up announcement

With ADR028 approved, the bounty is active, providing the attacker an opportunity to return a portion of the funds.

When finalised and submitted for mainnet adoption, node operators will be expected to upgrade promptly so the network can be brought back online safely and efficiently

The target is to have it on stagenet by EOD tomorrow, though the timeline is not finalised

ADR028 has been approved by nodes. The next major step is cutting and testing v3.19.0, with additional changes to be tested on stagenet before mainnet.

Nodes have upgraded to v3.18.1, which includes a patch restoring Rujira Network's ability to manage credit accounts (borrow / repay)

THORChain Incident Update #5 Developers and security teams are focused on restoring the network safely, prioritising correctness over speed. Security and stability remain the top priorities

THORChain is a decentralised cross-chain liquidity protocol and Layer 1 DEX, not a bridge. A correction would be appreciated

Official THORChain communication channels are the only sources for updates Contributors continue investigating the incident alongside THORSec and external security partners; more information will be shared

Initial findings indicate no user funds were lost in the incident THORChain is not running any refund, airdrop, or compensation program Any account claiming otherwise is impersonating THORChain or spreading

THORChain incident update #2 Multiple fake accounts and false information are circulating about “refunds”, “airdrops”, compensation claims, and other alleged initiatives

Updates will be provided as more information becomes available. Gratitude is extended to developers, node operators, security contributors, and the broader THORChain community for the extensive coordination

No final decisions have been made. Work continues on a full recovery and restart plan; returning trading and full functionality will likely take several days and could take longer depending on the remediation

Recovery will likely require node governance decisions on handling losses. Options being discussed include slashing bonds of nodes in the affected vault, letting POL absorb the loss, or alternative recovery

Trading, signing, LP actions, and other sensitive functions will remain paused until a community-aligned recovery and remediation plan is agreed.

The development team is currently comfortable allowing the pause to expire to restore RUNE transfers and chain observation.

Multiple node operators executed make pause, so the network is currently paused. Unless further action is taken, the pause will automatically expire in approximately 12 hours.

The Treasury is collecting forensic data and coordinating with Outrider Analytics and relevant law enforcement to identify the attacker and pursue recovery of stolen funds where possible.