Thorchain hacked.
"
We have identified unauthorized outbound transactions from one of the Asgard vaults. As a result, funds were lost from that vault. This investigation is still in its very early stages, and the information below is preliminary and subject to change as we continue analysis. We ask the community to give the node operators and development teams time to complete a thorough investigation before drawing conclusions. What we currently know:
- One of the six Asgard vaults appears to have been compromised.
- Current estimates place the loss at approximately $7.4m USD.
- The network automatically detected the abnormal behavior and halted signing activity, which alerted the broader community and prevented further outbound activity.
- Node operators securing the vault maintain bonded RUNE which is subject to slashing in the event of unauthorized outbound transactions.
- Churn activity has been paused while the investigation is ongoing and remediation steps are evaluated.
- As a result, onboarding of additional chains and any operations requiring churns will be delayed until the network is stabilized.
At this stage, the root cause has not yet been determined. Current areas under investigation include:
- A potential vulnerability in the GG20 implementation layer
- Infrastructure or operational compromise affecting a sufficient number of nodes
- Other attack vectors that could have enabled unauthorized signing activity
At this time, we do not have evidence supporting any specific conclusion, and we want to avoid premature assumptions until the investigation is complete. We are asking all node operators to immediately review their infrastructure, hosts, key management systems, and operational security for any signs of compromise or abnormal behavior, and to report anything suspicious to the dev team. Additionally, node operators participating in the affected vault are requested to securely provide Bifrost logs to the dev team for analysis using make relay. We will continue to provide updates as we learn more.
"