New Discord Announcement from THORChain Devs #🚨thornode-mainnet

**Vote ADR-23: Reserve Restructuring**

[ADR-23 Proposal Full Text](https://gitlab.com/boonew/thornode/-/blob/develop/docs/architecture/adr-023-rune-supply-restructure.md)

Summary of proposal:
1) Burn ~87% of the Reserve (~65m RUNE): https://runescan.io/address/thor1dheycdevq39qlkxs2a6wuuzyn4aqxhve4qxtxt
2) Reduce the Maximum Supply to 360M to protect the FDV supply reduction

Other Considerations:
- This change is a change in tokenomics, which usually requires broad community consensus and further outreach (eg Binance)

ADR Discord channel:
<#1473355028503728311>
ADR-23 Discussion Thread: https://discord.com/channels/838986635756044328/1473355821533368432/1473355899186970748

To vote on this ADR, nodes should:
`make mimir`
key: `ADR23`
values:
`1` to vote for
`0` to vote against
Check current vote status [here](https://rune.tools/voting?key=adr23)

Please `make relay` with explicit dissenting opinions, or contribute to the discussion thread (link above). This ADR will pass once >2/3 of the active validator set approves.

Thanks for participating @here

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

**Nine Realms Transition Announcement**

After several years contributing to THORChain's development and operations, over the next six weeks, Nine Realms will be gradually stepping back from our active roles in the ecosystem. There is a thread on this topic, please follow here for more info/discussion.

https://discord.com/channels/838986635756044328/838986636665815072/1483511027478958150

New Discord Announcement from THORChain Devs #🛡interface-alerts

## Router V6

The new router version alleviates issues with out-of-gas outbounds to smart contract wallets, and paves the path for future work to batch outbounds and support direct token transfers to vaults. The new router is live on all chains in `stagenet` and all integrators that are able are requested to test their flows there and flag any concerns.

We plan to upgrade the routers at the first churn of the week Tuesday or later, every 2 weeks, in order of increasing TVL:
- BASE (~$100k): week of March 30
- AVAX (~$500k): week of April 13
- BSC (~$1m): week of April 27
- ETH (~$12m): week of May 11

The router upgrade runbook for a given chain is as follows:
1. Set `MimirUpgradeContract<chain>=1`
2. Set `Halt<chain>Trading=1` 1h in advance of churn
3. Set `StopSolvencyCheck<chain>=1` 10 minutes before churn
4. Wait for churn to complete
5. Set `EVMAllowanceCheck-<chain>=1` to unblock token outbounds
6. Set `StopSolvencyCheck<chain>=0` to re-enable solvency check
7. Wait 1h to ensure no observed issues
8. Set `Halt<chain>Trading=0`

### ‼️Loss of Funds‼️
All integrators must ensure they are using the vault and router from `/thorchain/inbound_addresses` or the `/thorchain/quote` endpoints. Do not hardcode the router or cache the router and vault address independently. Every vault maps to exactly one router, and if sent to the wrong router for a vault funds will be lost. If funds are sent to a new vault with the old router, funds are lost. If funds are sent to an old vault with the new router, the inactive vault refund will fail and funds are lost.

Please reach out to devs in thread with any questions.

@here

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

### Nine Realms Endpoints
There are still a significant number of clients leveraging 9R public endpoints. We will be placing temporary redirects in front of our endpoints starting tomorrow to point at alternate locations on Liquify and others. The redirects will help to smooth the transition, but they will only be in place for a few weeks and clients may not automatically handle redirects.

All clients are recommended to migrate ASAP to avoid disruption. More details in announcement: https://discord.com/channels/838986635756044328/1161364032306028635/1483521870346191003

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

## THORNODE 3.16.3❗️GAIA 27.1.0❗️VALIDATORS ONLY
https://gitlab.com/thorchain/thornode/-/releases/v3.16.3

NETWORK: MAINNET
TYPE: Non-coordinated
URGENCY: ASAP

This is primarily a Bifrost patch release containing a minor fix to reduce likelihood of the first token outbound for a vault on router V6 being delayed by one reschedule. We will keep `BASE` trading paused until a quorum of all vaults has adopted to prevent poor UX. The patch release also exposes supply endpoints for CMC and similar, so those services may be migrated from the custom 9R endpoints to any `thornode` API provider.

Included in this install is a critical scheduled update for Gaia `27.1.0` occurring in ~20h. Please also note that there were some lint changes that went into `node-launcher` recently, which will result in whitespace and format diffs on most charts during apply.

```
make update
```

Then verify your node version is properly set to `3.16.3` and `make set-version` if the automatic version set did not apply.

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

## THORNODE 3.16.4❗️MAINNET❗️VALIDATORS ONLY
https://gitlab.com/thorchain/thornode/-/releases/v3.16.4

NETWORK: MAINNET
TYPE: Non-coordinated
URGENCY: ASAP

This is a Bifrost patch release containing a fix to prevent Solana double spend (one occurred yesterday when 1/3 of nodes fell behind on observations). Once a quorum of all vaults have adopted, it will be safe to resume Solana trading and signing.

```
make update
```

Then verify your node version is properly set to `3.16.4` and `make set-version` if the automatic version set did not apply.

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

**ADR-25: Update Dev Fund Address <a:votingparrot:857384577382482010> **

With Nine Realms stepping back from the project, we need to send the dev fund to a new address. Discussion has been open for a week with no one voicing any concerns around this change. This is largely a housekeeping change rather than something controversial.

I want to make sure this change is in the next release (3.17) which should be cut on April 5th. There is a [tiny MR](https://gitlab.com/thorchain/thornode/-/merge_requests/4698) to make this change which is approved by devs but not merged yet. We'll give nodes the next few days to vote on this ADR or use `make relay` to make arguments against this change, but I expect there to be no resistance here, imo.

Full writeup of ADR 25 is [here](https://gitlab.com/thorchain/thornode/-/blob/develop/docs/architecture/adr-025-migrate-dev-fund-address.md?ref_type=heads), if anyone wants to read it.

ADR Discord channel: <#1488477141019529357>

To vote on this ADR, nodes should:
make mimir
key: ADR25
values:
`1` to vote for
`0` to vote against

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

## GAIA 27.2.0❗️VALIDATORS ONLY

NETWORK: MAINNET
TYPE: Non-coordianted
URGENCY: 24h

This install includes a required upgrade for Gaia `27.2.0` scheduled tomorrow at https://www.mintscan.io/cosmos/block/30675400.

```
make pull
make install
```

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

### Stuck Churn

There is stuck Solana outbound that was successfully broadcast, but later dropped from mempool and now blocking churn completion. There will be a patch in a future version to handle this circumstance. Nodes in the culprit vault `thorpub1addwnpepqdrf73rpn0ew26ds2v544dtdg782m3a0uvhaxdaxzdjd7k2ylt932n3pqvu` are requested to clear their Solana signer cache to allow the outbound to be re-attempted.

```
thor1yak0z56elhcfqw7xn7wjmp43ndnnxgfcmwkwex
thor1vvmt4q6h7w4gckcjh22z6ltjcppjz3laydnfzq
thor1ug5gy49ges0umfna70gpccj3rae4n0px2qmv82
thor100m5hh9qayap0edmvl9h8er4z6uesnfazjmefg
thor1krwlgcs3q7duapyxwxzpra5779fgh5gzh6gfaq
thor1agftrgu74z84hef6dt6ykhe7cmjf3f8dcpkfun
thor1kj56aupxnkhhy0rpdcp2gjncm4y78nnhjv496v
thor1h4kjq4xrxsm7ajpkstqgp9jcwxlc8khyfpwkfr
thor18h4xkczkd7g765n647t8clzp58cqet44n9s69g
thor1raynyffujzs7wqujwtnyp9ryludjvpe0s9tacs
thor1hjpct8pd9d48vyqltaqunltwx9twm57l3qmaya
thor19uyg2vvsja9cfpejdj0c6pm7exfk87envj5s5h
thor15qcqwmwu002gfu4ynwee5nhqy62j268e3dmw0q
thor1va3av7xeq57jyy5jr3wumw3ezg6vs6ldy9geqf
thor12espg8k5fxqmclx9vyte7cducmmvrtxll40q7z
thor1d7rerzkzus2t6v2yv9wuw9xg8a8aqse8p6nvm8
thor1sh72x9rac8ahkya76zljql3mw7t96ywsjlzw0n
thor15x0q6r84n2ac38gdlrct5ncchj5d4cr76jfaaf
thor1fuw5nemuww2gclznelfrdzpj6eml0fnmhgphew
```

If you are a node in the set above, please perform the following:
```
make debug
# select cosmosfullnode
# select thornode
# select bifrost
rm -rf /var/data/bifrost/observer/SOL/
# exit shell and ensure bifrost starts back up
```

Once a quorum of the vault have cleared their signer cache and the outbound can be sent and churn can complete.

@here

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

THORNODE ❗️MAINNET❗️UPDATE 3.17.0
https://gitlab.com/thorchain/thornode/-/releases/v3.17.0

NETWORK: MAINNET
TYPE: Non-coordinated
URGENCY: 20h

The upgrade proposal has passed. Please install to schedule the upgrade at the proposed height. Nodes will automatically update to the new image at the scheduled height, and the node version for active validators will be automatically set at that time. All non-active validators must run make set-version after the upgrade height to be eligible for the subsequent churn.

```make pull
make install```


@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

## THORNODE ❗️ MAINNET ❗️ UPDATE 3.18.0
https://gitlab.com/thorchain/thornode/-/releases/v3.18.0

NETWORK: MAINNET
TYPE: Coordinated
URGENCY: 48h

The upgrade proposal has passed. Please install to schedule the upgrade at the proposed height. Nodes will automatically update to the new image at the scheduled height, and the node version for active validators will be automatically set at that time. All non-active validators must run `make set-version` after the upgrade height to be eligible for the subsequent churn.

> Remember this upgrade includes a private docker image that includes security fixes which active nodes can request a patch by `make relay` an [age](https://github.com/filosottile/age) public key

```
make pull
make install
```

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

## 🔓 v3.18.0 Source Disclosure
https://gitlab.com/thorchain/thornode/-/releases/v3.18.0

The two security patches that shipped in the v3.18.0 private image are now public.

**Disclosure tag**: `v3.18.0-disclosed` → commit `af46db22bd`
**Diff vs public release**: https://gitlab.com/thorchain/thornode/-/compare/v3.18.0...v3.18.0-disclosed
**Deployed image digest**: `sha256:6ed0c6c5d87dbdd0fe1e51b69050fa68cac20ef67803c757efcfcbb6fe133f5f`

Operators who want to verify the running binary against the disclosed source:
```
git fetch
git checkout v3.18.0-disclosed
BRANCH=mainnet BUILDTAG=mainnet make docker-gitlab-build
docker inspect --format '' registry.gitlab.com/thorchain/thornode:mainnet
```

Anyone who previously requested the encrypted patch via age can now disregard — the same source is publicly available at the tag above.

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

**🚨 ALERT 🚨**

We have identified unauthorized outbound transactions from one of the Asgard vaults. As a result, funds were lost from that vault.

This investigation is still in its very early stages, and the information below is preliminary and subject to change as we continue analysis. We ask the community to give the node operators and development teams time to complete a thorough investigation before drawing conclusions.

What we currently know:

- One of the six Asgard vaults appears to have been compromised.
- Current estimates place the loss at approximately $7.4m USD.
- The network automatically detected the abnormal behavior and halted signing activity, which alerted the broader community and prevented further outbound activity.
- Node operators securing the vault maintain bonded RUNE which is subject to slashing in the event of unauthorized outbound transactions.
- Churn activity has been paused while the investigation is ongoing and remediation steps are evaluated.
- As a result, onboarding of additional chains and any operations requiring churns will be delayed until the network is stabilized.

At this stage, the root cause has not yet been determined.

Current areas under investigation include:
- A potential vulnerability in the GG20 implementation layer
- Infrastructure or operational compromise affecting a sufficient number of nodes
- Other attack vectors that could have enabled unauthorized signing activity

At this time, we do not have evidence supporting any specific conclusion, and we want to avoid premature assumptions until the investigation is complete.

We are asking all node operators to immediately review their infrastructure, hosts, key management systems, and operational security for any signs of compromise or abnormal behavior, and to report anything suspicious to the dev team.

Additionally, node operators participating in the affected vault are requested to securely provide Bifrost logs to the dev team for analysis using `make relay`.

We will continue to provide updates as we learn more.

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

🚨 ALERT 🚨

Developers and THORSec have been investigating today’s incident continuously throughout the day. While new information may still emerge, I want to provide the community with an update based on what we currently know.

The goal of this update is to clarify the current understanding of the situation as accurately and transparently as possible.

A newly churned node, thor16ucjv3v695mq283me7esh0wdhajjalengcn84q, which entered the network several days ago, is currently believed to be associated with the attack. Developers have identified links between Ethereum addresses used to acquire and bond RUNE for this node, and Ethereum addresses that later received the stolen funds. Based on current evidence, it is believed this was conducted by a single malicious operator, though the investigation remains ongoing.

At this time, the leading theory is the attacker exploited a vulnerability within the GG20 TSS implementation which allowed sensitive key material from vault participants to leak over time. By accumulating enough leaked information, the attacker was ultimately able to reconstruct the vault’s TSS private key and execute unauthorized outbound transactions.

The Treasury is actively collecting forensic data and coordinating with Outrider Analytics and relevant law enforcement agencies in an effort to identify the attacker and pursue recovery of stolen funds where possible.

Due to multiple node operators executing make pause, the network is currently paused. Unless further action is taken, the pause state will automatically expire in approximately 12 hours. At this time, the development team is comfortable allowing the pause to expire in order to restore RUNE transfers and chain observation activity.

However, trading, signing, LP actions, and other sensitive operations will remain paused until the network and community align on a comprehensive recovery and remediation plan.

The recovery process will likely require node governance decisions regarding how losses are ultimately handled. Several potential approaches are already being discussed, including:

Slashing the bond of nodes participating in the affected vault
Allowing Protocol-Owned Liquidity (POL) to absorb the loss
Additional recovery proposals that may emerge from the broader community

At this stage, no final decisions have been made.

The team is continuing to work on a complete recovery and restart plan for the network. Bringing trading and full functionality back online will likely take several days, and potentially longer depending on the complexity of the chosen remediation path.

We will continue to provide updates as more information becomes available.

Finally, I want to thank the developers, node operators, security contributors, and the broader THORChain community for the enormous amount of work done today. One of THORChain’s greatest strengths has always been the community’s ability to come together under pressure, collaborate quickly, and solve difficult problems together.

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

Hello THORChads,

The developers and thorsec teams have been hard at work throughout the weekend continuing the investigation to fully understand the events that took place, while also planning the road to recovery. I wanted to provide an update to keep the community informed as we move forward. It is important to note that the investigation is still ongoing, and details may change in the coming days as we continue to gather information and adjust plans accordingly.

At this time, the team has a strong understanding of what occurred and how the attack was executed, though we are not yet in a position to publicly discuss the technical details. What we can say is that the attack vector does not appear to be related to any currently known GG20 exploits, and at this stage we are still assessing whether other GG20 implementations could also be at risk. The team will continue investigating this possibility and will coordinate with other affected teams as appropriate.

We would also like to thank the many cryptographers and security researchers who assisted throughout this process, including members of the team that originally developed GG20.

The team currently expects to release version 3.18.1 tomorrow for node operators to adopt. We ask that all node operators upgrade to this release as soon as possible.

There is also an open question regarding the best approach for handling the lost funds within the network. This will need to be discussed and ultimately decided by the community through governance. To facilitate this discussion, I have created the channel <#1505953830796263424> .

Before the network can return to a fully healthy state, we will need broad consensus on this ADR, after which the selected approach will be implemented as part of the 3.19 release. THORChads are encouraged to share well-structured and thoughtful proposals for the community to support or challenge. In the coming days, we will organize a vote highlighting the most widely supported approaches for node operators to actively vote on.

Regarding the future direction of the cryptographic systems used to secure the vaults, that discussion is still ongoing and requires additional research before any long-term decisions are made. For the immediate future, the team is currently leaning toward remaining on GG20 in order to restore network health and stability as quickly and safely as possible. Longer-term discussions around the future of THORChain’s cryptographic security model will continue once the network has stabilized.

As always, I am proud of how both the team and the community have handled this situation. We will get everything running again as soon as we can, but we are not going to rush the process. THORChain has a strong roadmap ahead, and I am excited for us to return our focus to continuing to push the envelope of what this project can achieve.

Onwards to Valhalla

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

Hello Thorchads!

We ask all active validators to please scale down their bifrost pods, **from now until 3.18.1 patch is live**. We request this in an abundance of caution while vulnerabilities are identified and patched.

```
make pull
make scale-down
# choose bifrost
```

> If you have trouble scaling down your bifrost pod, please reach out to devs via make relay or on discord.

Thank you for your cooperation!

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

THORNODE ❗️MAINNET❗️UPDATE 3.18.1
https://gitlab.com/thorchain/thornode/-/releases/v3.18.1

NETWORK: MAINNET
TYPE: Non-coordianted
URGENCY: ASAP

This is a Bifrost-only patch containing a fix to ensure bifrost-internal signing flows honour the HALTSIGNING / HaltSigning switches.

```
make scale-up -> bifrost
make pull
make install
```

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

THORNODE ❗️MAINNET❗️UPDATE 3.18.1
https://gitlab.com/thorchain/thornode/-/releases/v3.18.1

NETWORK: MAINNET
TYPE: Non-coordianted
URGENCY: ASAP

This is a Bifrost-only patch containing a fix to ensure bifrost-internal signing flows honour the HALTSIGNING / HaltSigning switches.

```
make scale-up ->bifrost
make pull
make install
```

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

## THORNODE ❗️MAINNET❗️ HALT SECURED + TRADE ASSETS

NETWORK: MAINNET
TYPE: Coordinated (3 votes only)
URGENCY: ASAP

Close the secured asset and trade asset surfaces while the tss-lib patch lands. Complements the existing *HALTTRADING* / *HALTSIGNING* / *STOPSOLVENCYCHECK* halts already in effect. Operational mimirs — only 3 votes needed each to set.

Note: HALTSECUREDGLOBAL is currently unset; TRADEACCOUNTSENABLED is currently 1 (flip to 0 to halt).

```
MIMIR_KEY=HALTSECUREDGLOBAL MIMIR_VALUE=1 make mimir
MIMIR_KEY=TRADEACCOUNTSENABLED MIMIR_VALUE=0 make mimir
```

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

THORNODE ❗️MAINNET❗️ BAN NODE

NETWORK: MAINNET
TYPE: Coordinated
URGENCY: ASAP

Vote to ban this node (⅔ supermajority required — 63 of 93 active nodes):

```
make pull
make ban
# at the prompt enter: thor16ucjv3v695mq283me7esh0wdhajjalengcn84q
# the script will confirm:
# address : thor16ucjv...cn84q
# ip : 64.95.10.143
# slash : 195222
# operator : thor16ucjv...cn84q (self-bonded)
# confirm y → broadcast
```

@everyone

New Discord Announcement from THORChain Devs #🚨thornode-mainnet

THORNODE ❗️MAINNET❗️UPDATE 3.18.2
https://gitlab.com/thorchain/thornode/-/releases/v3.18.2

NETWORK: MAINNET
TYPE: Non-coordianted
URGENCY: ASAP

This is a Bifrost-only patch containing a fix to repair dead unhealthy-scanner solvency guard
and adding per-chain floor block height for bifrost scanner + remove dead block-status ledger.

```
make update
```

@everyone