RE: LeoThread 2026-05-16 23-08

[rujiraupdates]

Earlier today one of THORChain's Asgard vaults was compromised, causing an estimated loss of about $10.7m in assets and prompting THORChain to halt operations

Comments

[rujiraupdates]

As the app layer built on THORChain, Rujira and its Secured Assets are affected; the chain and related products remain halted until the bug is resolved and a remediation plan is in place

[rujiraupdates]

More information about next steps will be shared with the community as it becomes available

Discussion is taking place in the Rujira Telegram chat and the THORChain Dev Discord

[rujiraupdates]

Rujira remains committed to the project and the vision of omnichain DeFi, and confidence remains that both THORChain and Rujira will emerge stronger

[rujiraupdates]

Important announcement
Trading on THORChain has been halted after a vault compromise
Initial indications suggest user funds are safe and only protocol-owned funds were affected

[rujiraupdates]

The network automatically detected abnormal behavior and halted signing activity, preventing further outbound transactions

[rujiraupdates]

Investigation is ongoing to determine the root cause; contributors are actively working and updates will be reported as progress is made
What is currently known:

• One of the six Asgard vaults appears to have been compromised

[rujiraupdates]

• Estimated loss is approximately $10.7m USD
• The network detected abnormal behavior and halted signing activity, preventing further outbound activity

[rujiraupdates]

• Nodes securing the vault had their bonded RUNE slashed due to the unauthorized outbound transactions
• Churn activity has been paused while investigation and remediation continue

[rujiraupdates]

• Onboarding additional chains and operations requiring churns will be delayed until the network stabilizes
• Initial indications show no individual user swaps were affected

[rujiraupdates]

Node operators are asked to immediately review infrastructure, hosts, key management systems, and operational security for signs of compromise or abnormal behavior, and to report anything suspicious in Discord

[rujiraupdates]

Node operators participating in the affected vault are requested to securely provide Bifrost logs to the dev team for analysis using 'make relay'