Edited By
David Kim

The THORChain team is deep into an investigation following a recent security incident. Developers and the THORSec team have been analyzing the attack's execution while formulating a recovery plan. As they continue to assess the situation, some key developments are emerging.
The investigation is still underway, with the team confident about the attack's details but unable to share all technical specifics yet. Notably, they confirmed that the attack vector does not seem to involve any recognized GG20 exploits, although there remains uncertainty around the overall security of other GG20 implementations.
Team members expressed gratitude to independent cryptographers and security researchers who provided essential support throughout this crisis.
"Thanks for the update. Glad the team is moving fast with the fix," one community member commented, highlighting the overall positive sentiment as recovery plans begin.
The developer team is set to release a new version for node operators on May 20, 2026. They strongly encourage all operators to upgrade promptly. A significant aspect of the recovery process involves a community discussion about how to handle lost funds, which will be governed by community consensus through governance.
To facilitate this, a dedicated channel on Discord titled adr-028-tss-exploit-recovery has been established. Community members โ referred to affectionately as THORChads โ are encouraged to submit structured proposals for other members to evaluate.
There are ongoing discussions about the cryptographic systems used for securing vaults. Currently, the team is leaning toward continuing with GG20 to quickly restore network stability. Still, the long-term security model is subject to thorough research and deliberation.
Some comments reflect a cautious optimism, with users expressing hope for effective proposals in the upcoming governance discussions. A user aptly noted, "Hope the recovery discussion goes well for everyone affected."
Key Insights:
Node Operator Upgrade: A new version release is imminent; operators must update to stabilize the network.
Community Governance: Decisions on managing lost funds will be community-driven.
Future Security Model: Remaining on GG20 appears likely, but discussions for long-term solutions are ongoing.
In light of these developments, the sentiment around THORChain's path forward seems cautiously optimistic, with a community eager to engage in discussions that shape the future of the network. Together, they aim to ensure that the network emerges stronger than before.
Thereโs a strong chance that THORChain will stabilize quickly once the new node operator version launches on May 20, 2026. This prompt update is critical, and operators adhering to the timeline could see the network return to full functionality in weeks. Moreover, as community discussions around governance take place, experts estimate around a 70% probability that the group will reach a consensus on handling lost funds, restoring trust and promoting engagement. With a combined effort from developers and THORChads, the network may emerge from this setback with enhanced security measures, allowing for a more resilient infrastructure moving forward.
This situation bears a striking resemblance to the aftermath of the 2003 Northeast blackout in the United States. That incident forced communities to come together, innovate, and adapt, resulting in improved infrastructure and protocols to prevent future occurrences. Just as cities rebuilt stronger power grids after a collective crisis, THORChain may very well find that this incident sparks a revitalization of community involvement and a shared commitment to safeguarding the network's future. In both cases, adversity prompted collaboration and strengthened foundations, revealing that sometimes the most significant growth happens in the wake of failure.