THORChain disclosed a security incident involving the compromise of one of six Asgard vaults, with losses estimated at approximately $10.7 million.

The network’s automated detection systems identified unauthorized outbound transactions and halted signing activity, preventing further fund transfers. The incident was announced via Discord and social media.

The root cause of the compromise has not yet been determined. According to a Discord announcement shared by security expert Taylor Monahan, THORChain’s development team is investigating multiple potential vectors, including a vulnerability in the GG20 implementation layer, infrastructure or operational compromise affecting node operators, and other attack vectors that could enable unauthorized signing activity.

The network has paused churn activity—the process by which validators are rotated—while the investigation continues and remediation steps are evaluated. As a result, onboarding of additional chains and any operations requiring churns will be delayed until network stability is restored.

Thorchain’s RUNE token is down 15% in the past 24 hours.

Node operators securing the compromised vault maintain bonded RUNE tokens subject to slashing in the event of unauthorized transactions.

The development team has requested all node operators to immediately review their infrastructure, key management systems, and operational security for signs of compromise. Node operators from the affected vault have been asked to provide Bifrost logs to the development team for analysis.

The team emphasized that the investigation remains in early stages and preliminary, with the development team requesting the community allow time for a thorough analysis before drawing conclusions.

Sources: THORChain Developers (via @tayvano_), ThorChain X Post

This article was produced with the help of AI flows.