THORChain: RUNE transfers expected to resume in 12 hours, attack may be caused by GG20 TSS vulnerability

Jinse Finance reported that on May 16, THORChain released an update on the hacking incident via platform X. Preliminary evidence indicates that a recently joined node in the network was suspected of being controlled by a malicious operator, who exploited a GG20 TSS vulnerability to obtain vault participant key information, ultimately reconstructing the vault’s private key and executing unauthorized fund withdrawals. Currently, several THORChain nodes have been shut down, resulting in the suspension of the network. RUNE transfers are expected to resume in approximately 12 hours.