Phoenix 🔥

🔥 Fire chicken 🔥

Blockchain enthusiast and lover of video games, fitness, technology and music festivals | 🏗️​ Web3 BUIDLer 🏗️

[THORChain @THORChain]

THORChain incident update #1
THORChain contributors shared a new update in the dev discord regarding the ongoing incident.

TLDR
- Current evidence points toward a newly churned node linked to the attack, likely operated by a single malicious actor

- The leading theory is an exploit in the GG20 TSS implementation, allowing vault key material to leak over time. The attacker may have reconstructed the vault private key and executed unauthorized outbound txs

- Current network status:
-- The network is paused after multiple node operators executed make pause
-- RUNE transfers and chain observation may resume within ~12h unless decided otherwise by the nodes.
-- Trading, LP actions, signing, and sensitive operations remain paused for now

- Recovery discussions currently include slashing affected node bonds, using POL to absorb losses, or other community-driven solutions

The investigation is still ongoing alongside THORSec and Outrider Analytics.

## Full Announcement ##
Developers and THORSec have been investigating today’s incident continuously throughout the day. While new information may still emerge, I want to provide the community with an update based on what we currently know.

The goal of this update is to clarify the current understanding of the situation as accurately and transparently as possible.

A newly churned node, thor16ucjv3v695mq283me7esh0wdhajjalengcn84q, which entered the network several days ago, is currently believed to be associated with the attack. Developers have identified links between Ethereum addresses used to acquire and bond RUNE for this node, and Ethereum addresses that later received the stolen funds. Based on current evidence, it is believed this was conducted by a single malicious operator, though the investigation remains ongoing.

At this time, the leading theory is the attacker exploited a vulnerability within the GG20 TSS implementation which allowed sensitive key material from vault participants to leak over time. By accumulating enough leaked information, the attacker was ultimately able to reconstruct the vault’s TSS private key and execute unauthorized outbound transactions.

The Treasury is actively collecting forensic data and coordinating with Outrider Analytics and relevant law enforcement agencies in an effort to identify the attacker and pursue recovery of stolen funds where possible.

Due to multiple node operators executing make pause, the network is currently paused. Unless further action is taken, the pause state will automatically expire in approximately 12 hours. At this time, the development team is comfortable allowing the pause to expire in order to restore RUNE transfers and chain observation activity.

However, trading, signing, LP actions, and other sensitive operations will remain paused until the network and community align on a comprehensive recovery and remediation plan.

The recovery process will likely require node governance decisions regarding how losses are ultimately handled. Several potential approaches are already being discussed, including:

Slashing the bond of nodes participating in the affected vault
Allowing Protocol-Owned Liquidity (POL) to absorb the loss
Additional recovery proposals that may emerge from the broader community

At this stage, no final decisions have been made.

The team is continuing to work on a complete recovery and restart plan for the network. Bringing trading and full functionality back online will likely take several days, and potentially longer depending on the complexity of the chosen remediation path.

We will continue to provide updates as more information becomes available.

Finally, I want to thank the developers, node operators, security contributors, and the broader THORChain community for the enormous amount of work done today. One of THORChain’s greatest strengths has always been the community’s ability to come together under pressure, collaborate quickly, and solve difficult problems together.

[THORChain @THORChain]

THORChain will never die.

[Rujira @RujiraNetwork]

The Merge has ended, and you can now withdraw your RUJI from the merge contract.

In the thread below, we show you how to withdraw and stake your RUJI, so you are ready to earn a fair share of Rujira ecosystem rewards when staking reward distribution begins in the future.

[Kenton Ralph Toews @KentonC137]

$RUNE

[THORChain @THORChain]

The art of native swaps. ⚡️

[Rujira @RujiraNetwork]

We just crossed $100k in total borrowed assets on Rujira.

Each milestone shows more people are using decentralized markets built around native assets, transparency, and equal opportunity for everyone.

Thank you for being early. Bigger things ahead.

Onwards!

[Unstoppable | Privacy Wallet @unstoppablebyhs]

While You Were Gambling, THORChain Quietly Became the Real DEX!

While degenerates were busy with pump & dumps on @Pumpfun and casino plays at @Polymarket some were actually building the freedom stack.

@THORChain is one of those projects. The majority of CT and pro-KYC folks trading on CEXes still don't grasp the importance and level of decentralization of this project.

Here’s what you probably don’t know:

1) This is the DEX everyone tried to build and failed.

No bridges. No wrappers. No custodians. Swap native assets directly. No middleman.

2) Fully decentralized

Run by a distributed set of nodes, community participants, and its own treasury.

No central entity. No single point of failure. Everyone is replaceable.

3) The swap pioneer

Streaming swaps. A swap where large orders are split into smaller ones letting arbitrage bots work for you, not against you. All done without you even knowing it.

You can move serious 9-digit swaps at rates rivaling the biggest centralized players.

4) It inspired an entire wave of forks.

One of the most notable: @Maya_Protocol. Built on similar architecture but pushing further (e.g. native ZEC swaps).

So, while most are still chasing narratives some are building the rails.

[Rujira @RujiraNetwork]

There are still exogenous assets on Kujira 🤯

If any of them are yours, please move them out as soon as possible. After the end of June, there will be nothing we can do to recover them.

Read on if this affects you 🧵👇

[THORChain @THORChain]

Tree of THORChain

[RUNEBond @RUNEBondApp]

Limit Orders are now live on @THORChain, and that matters because new trading functionality tends to attract more activity. More activity means more volume, more volume means more fees, and more fees translate directly into better APY for the $RUNE that secures the network.

Right now that can mean up to 26.55% APY, generated from real usage of the protocol. If your RUNE is not participating, it is simply not earning from that growth.

Before bonding, most users want clarity on how it works and what to expect. We have answered the most common questions in our documentation 👇

[Rujira @RujiraNetwork]

@BitcoinPierre 17 years later, we are building an omnichain DeFi hub for native Bitcoin.

In 2026, your BTC can start earning more BTC - 24/7.

[THORChain @THORChain]

Crypto isn't about getting rich quick on the next dog coin.
It's about building financial infrastructure that works when banks don't, when borders close, when permission gets denied.

The tech that matters is the tech that can't be shut down.
Everything else is noise. ⚡

[Rujira Intern @Rujira_Intern]

@UUDDLRLRBASeSt @THORChain @RujiraNetwork We already have this on Rujira and you can do it from the same window - unified experience.

You can withdraw assets to another chain within 20 seconds.

It's just depending on TC-outbound/chains how long it takes to arrive after the TX on THORChain is confirmed.

[Phoenix 🔥 @Phoenix_Web3x]

@marcelharmann All 🤡🤡🤡

[Phoenix 🔥 @Phoenix_Web3x]

Every day there are more scammers on freelancer platforms, and this has a very negative impact on the IT sector and especially on the DeFi sector.
--- End of the 🧵 ---

[Phoenix 🔥 @Phoenix_Web3x]

POV: You've got some small job through @Upwork and after reviewing the repository you find this. What would you do? 🧵

[Phoenix 🔥 @Phoenix_Web3x]

I hate it when a platform that is supposed to provide security and contract quality to all freelancers, such as @Upwork, is unable to validate these types of cases.