Kid (Agentic Arc)

Station is live. The wallet Terra users trusted is back, rebuilt as the world's first fully agentic wallet. This is a major step forward for Station: safer custody, a stronger foundation, and the beginning of a new multi-chain future. And as users come in, we’ll keep moving fast: listening to reports, fixing issues, and improving the experience every day. Jump into the new universe, download it and try it. Post on X. Share what you like, what felt confusing, or what needs improvement. Any feedback helps us iterate and improve faster Our devs are watching closely. Discord and telegram are open. Station is back. And we’re just getting started.

Station Wallet launches tomorrow. Agentic, Multi-chain, MPC. Have you migrated your wallets yet?

⚡ This Saturday on the THORChain Podcast | Ecosystem & Community Spotlight. @QuaiNetwork joins @KentonC137 and @patriotsounds live at 10AM EDT / 2PM UTC. Quai Network is building an energy-based monetary system where energy becomes money. Jump on stage and ask your questions live: riverside.com/studio/thorcha…

THORChain Exploit Report #1 is now live. Full timeline of the May 15 incident, how the security layers responded, and what comes next via ADR-028. thorchain.org/blog/thorchain…

Station Wallet will be live in 5 days! The world’s first fully agentic wallet. Set the date. 25.05.2026 🚀

THORChain Incident Update #4 Following the events of May 15th, the community has been hard at work defining a path forward. ADR028 is now published and a vote is open for Node Operators. 🔹 The Recovery Plan 🔹 The protocol will absorb the loss first through Protocol-Owned Liquidity and the remainder is spread across synth holders (The exact split between the two is still being evaluated). By doing so, POL will be reduced to zero. The ADR proposes to redirect a portion of system income to replenish it over time. No new RUNE is minted, no RUNE is sold, and no holder is diluted. 🔹 The Technical Decisions 🔹 GG20 is kept in place for now, patched and upgraded. Trading resumes only after the vulnerability is patched and a successful churn has occurred. A slower, more security-conscious release cadence is also called for going forward. 🔹 The Slashing 🔹 Innocent nodes that end up being in the same vault as the attacker are protected. The attacker's node is slashed in full. The recovered RUNE is paired with whatever assets can be recovered from the affected vault, and any surplus RUNE is burned. 🔹 The White Hat Offer 🔹 The attacker is offered a bounty to return the funds. If funds are returned partially, the recovery plan rolls back proportionally. 🔹 Protocol Neutrality 🔹 THORChain remains neutral and permissionless. The attacker's swaps will not be censored once trading resumes. Node Operators are now voting on the overall direction and principles of this proposal. The figures in the ADR are indicative at this stage and will be adjusted later, notably via Mimir. The goal is to restart the network as soon as possible. A yes vote is a green light for developers to continue building in that direction. Full details of ADR028 gitlab.com/-/snippets/599292… For those who want to understand the full context of what happened, this article is for you: thorchain.org/blog/thorchain…

bRUNE has received an upgrade ⚡️ The bRUNE node whitelist now includes 50 Node Operators, and several operators shared feedback with us. Based on that feedback, we updated the bRUNE logic to make RUNE bonding more efficient 👇

THORChain incident update #1 THORChain contributors shared a new update in the dev discord regarding the ongoing incident. TLDR - Current evidence points toward a newly churned node linked to the attack, likely operated by a single malicious actor - The leading theory is an exploit in the GG20 TSS implementation, allowing vault key material to leak over time. The attacker may have reconstructed the vault private key and executed unauthorized outbound txs - Current network status: -- The network is paused after multiple node operators executed make pause -- RUNE transfers and chain observation may resume within ~12h unless decided otherwise by the nodes. -- Trading, LP actions, signing, and sensitive operations remain paused for now - Recovery discussions currently include slashing affected node bonds, using POL to absorb losses, or other community-driven solutions The investigation is still ongoing alongside THORSec and Outrider Analytics. ## Full Announcement ## Developers and THORSec have been investigating today’s incident continuously throughout the day. While new information may still emerge, I want to provide the community with an update based on what we currently know. The goal of this update is to clarify the current understanding of the situation as accurately and transparently as possible. A newly churned node, thor16ucjv3v695mq283me7esh0wdhajjalengcn84q, which entered the network several days ago, is currently believed to be associated with the attack. Developers have identified links between Ethereum addresses used to acquire and bond RUNE for this node, and Ethereum addresses that later received the stolen funds. Based on current evidence, it is believed this was conducted by a single malicious operator, though the investigation remains ongoing. At this time, the leading theory is the attacker exploited a vulnerability within the GG20 TSS implementation which allowed sensitive key material from vault participants to leak over time. By accumulating enough leaked information, the attacker was ultimately able to reconstruct the vault’s TSS private key and execute unauthorized outbound transactions. The Treasury is actively collecting forensic data and coordinating with Outrider Analytics and relevant law enforcement agencies in an effort to identify the attacker and pursue recovery of stolen funds where possible. Due to multiple node operators executing make pause, the network is currently paused. Unless further action is taken, the pause state will automatically expire in approximately 12 hours. At this time, the development team is comfortable allowing the pause to expire in order to restore RUNE transfers and chain observation activity. However, trading, signing, LP actions, and other sensitive operations will remain paused until the network and community align on a comprehensive recovery and remediation plan. The recovery process will likely require node governance decisions regarding how losses are ultimately handled. Several potential approaches are already being discussed, including: Slashing the bond of nodes participating in the affected vault Allowing Protocol-Owned Liquidity (POL) to absorb the loss Additional recovery proposals that may emerge from the broader community At this stage, no final decisions have been made. The team is continuing to work on a complete recovery and restart plan for the network. Bringing trading and full functionality back online will likely take several days, and potentially longer depending on the complexity of the chosen remediation path. We will continue to provide updates as more information becomes available. Finally, I want to thank the developers, node operators, security contributors, and the broader THORChain community for the enormous amount of work done today. One of THORChain’s greatest strengths has always been the community’s ability to come together under pressure, collaborate quickly, and solve difficult problems together.

Important Announcement Trading on THORChain is currently halted after a vault was compromised. Initial indications are user funds are safe and only protocol owned funds are affected. The network automatically detected abnormal behavior and halted signing activity, which alerted the broader community and prevented further outbound transactions. The investigation is still ongoing to determine the root cause. Contributors are actively working on the issue and we will report updates as we progress toward a solution. What we currently know: * One of the six Asgard vaults appears to have been compromised. * Current estimates place the loss at approximately $10.7m USD * The network automatically detected the abnormal behavior and halted signing activity, preventing further outbound activity. * Nodes securing the vault were subject to their bonded RUNE being slashed as a result of the unauthorized outbound transactions. * Churn activity has been paused while the investigation and remediation efforts are ongoing. * Onboarding additional chains and operations requiring churns will be delayed until the network is stabilized. * Initial indications show no individual user swaps were affected. We are asking all node operators to immediately review their infrastructure, hosts, key management systems, and operational security for any signs of compromise or abnormal behavior, and to report anything suspicious in Discord. Node operators participating in the affected vault are requested to securely provide Bifrost logs to the dev team for analysis using 'make relay' .

Every oracle, relayer, liquidation bot and risk dashboard in DeFi is downstream of an RPC. If that RPC serves bad data, the entire system acts on a false version of reality. There's no audit that catches this. The architecture either prevents it or it doesn't. THORChain prevents it. Every THORNode runs its own full node for each chain it supports. No shared RPC. No third party telling the network what's happening on Bitcoin or Ethereum. Each node verifies the state of every connected chain independently, and consensus only happens when they agree. This isn't a minor implementation detail. It's the difference between a protocol that knows what's true and one that trusts someone else's answer. THORNodes communicate and operate in cooperation to create a cross-chain swapping network, but that cooperation is built on independent verification, not shared assumptions. Time and time again, the design is proven correct.