THORChain has released a recovery plan for the attack incident, and node operator voting has begun.

CoinFeed reported on May 22 that THORChain released its fourth update regarding the May 15 attack. Proposal ADR028 has been published, and node operator voting has begun. According to the recovery plan, the protocol will first absorb the losses through its own liquidity, with the remaining losses shared by synthetic asset holders; the specific allocation ratio is still under evaluation. The protocol's own liquidity will be reduced to zero, and will be gradually replenished through system revenue. This plan will not issue or sell RUNE, nor will it dilute any holders. Technically, GG20 is temporarily retained and has been patched and upgraded. Trading will resume after the vulnerability is fixed and node rotation is successful. A slower, more security-conscious release schedule will be adopted in the future. Innocent nodes located in the same vault as the attacker will be protected, while the attacker's node will be fully forfeited. Recovered RUNE will be paired with recovered assets, and any excess will be destroyed.