RE: LeoThread 2026-05-29 15-40

Update on the exploit affecting one Asgard Vault, recent developer findings, and the expected impact
Key points:

• The exploit of one of the five Asgard Vaults is believed to stem from a GG20 bug and a single malicious node

• Block production has resumed and native token transfers are expected to be enabled soon
• For full functionality, developers are evaluating whether to patch GG20 or migrate to DKLS and will implement the chosen solution

• Withdrawals and deposits of Secured Assets remain frozen until Base Layer trading resumes
• App Layer activity will restart and products will function as intended once Nodes re-enable transfers

• Subject to a Nodes vote, the preferred path would preserve 1:1 backing for Secured Assets

The exploit appears linked to a GG20 bug and one malicious node; investigations continue and relevant agencies are being involved to identify the perpetrator. Developers will determine the best security route and a plan for handling lost funds, which the community and Nodes can vote on

Multiple node operators paused the network; block production has now restarted and native transfers are expected to resume shortly. The pause will remain until either a GG20 patch or a migration to DKLS is implemented. Patching is faster but carries a small risk of incomplete coverage; moving to DKLS is seen as a cleaner, more secure option that was already planned

What this means for users: once transfers are unpaused, RUNE, RUJI, and TCY can be sent again. Until Base Layer trading resumes, withdrawals and deposits of Secured Assets are not possible. App Layer activity is considered safe and operational; the exploit is isolated to a single Asgard Vault

Secured Assets are stored in Asgard Vaults without strict segregation, so on paper losses could be shared across PoL, LPs, Trade Assets, and Secured Assets. Roughly 1/5th of Secured Assets TVL—about $1M, with almost half in BTC from the protocol treasury—was exposed

The current plan is to use Protocol Owned Liquidity to compensate Trade and Secured Assets so affected balances are made whole. Secured Assets are therefore expected to retain full value and become withdrawable once trading on the Base Layer resumes

Regarding bonded RUNE via bRUNE: the malicious node was not whitelisted and had no bRUNE bonded; other nodes in the compromised vault did have bRUNE. If Nodes identify and vote to slash the malicious node, its RUNE could be fully slashed to cover losses and remaining nodes in the compromised vault refunded, keeping bRUNE-bonded RUNE safe

Assistance and continued discussions on accounting for the lost funds will occur over the coming days. Product development and improvements will continue, and further updates will be provided once there is news on the exploit, native asset transfers, and resumptions of activity on the platform