THORChain: malicious node leaked a vault key through GG20 TSS

What happened

• Root cause per THORChain’s exploit report: the leading theory is “an exploit in the GG20 TSS implementation allowing progressive key material leakage” by a new node that churned in on 13 May with about 635,000 RUNE. Investigation ongoing at the time of the report.
• Attribution: none beyond the malicious node operator.
• Response: the solvency checker halted signing and trading automatically about 52 minutes after the theft. Node operators halted trading, signing and churning. Patch v3.18.1. A USD 10M treasury-funded refund pool and recovery portal were later launched and trading resumed after about five weeks.

Sources

• https://blog.thorchain.org/thorchain-exploit-report-1
• https://blog.thorchain.org/thorchain-exploit-report-2
• https://cointelegraph.com/news/thorchains-10m-exploit-mpc-vulnerability-private-key-leak

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.