THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability

THORChain released an update on the hacking incident on platform X. Preliminary evidence suggests that a node that recently joined the network may have been controlled by a malicious operator, who exploited the GG20 TSS vulnerability to obtain key information from vault participants, ultimately reconstructing the vault private key and executing unauthorized withdrawal transactions. Currently, multiple THORChain nodes have been shut down, resulting in the network being in a paused state. RUNE transfers are expected to resume in about 12 hours, but the specific situation will depend on node decisions. Functions such as trading, liquidity provider operations, and signing are still unavailable, and a full restoration of network functionality is expected to take several days. Recovery plans are under discussion and may include reducing the staking of affected nodes, as well as other remedial measures proposed by the community.