THORChain published a recovery proposal on May 22 for the multichain exploit that forced an emergency halt on May 15, with one decision at the center: no new RUNE will be minted to compensate affected users, Cointelegraph reported citing the protocol's update post. Repayments instead come out of protocol revenue and existing reserves, stretched across time rather than pushed onto the token supply.
The wider tape is already heavy. BTC trades at $77,151 (down 0.8% on the day, down 4.3% on the week), ETH at $2,119 (down 0.6%, down 6.1% on the week), and SOL at $87.09 as of May 22, 2026, with the Fear & Greed Index sitting at 39 (Fear). A token holder dilution headline into this market would have been a second hit on top of the exploit. The no-mint decision removes that risk.
The choice between dilution and patience
Post-exploit recovery plans in DeFi usually fall into one of three patterns. Some protocols mint fresh tokens to backfill the hole, transferring the cost to existing holders through dilution. Others absorb the loss against treasury reserves and slow-bleed it through future protocol revenue. A third group lets affected users eat the loss directly, sometimes with a token claim against future fees.
THORChain has gone with the second route. The proposal earmarks protocol revenue and reserve assets to repay positions hit by the May 15 incident, without expanding RUNE supply. That keeps the inflation curve intact, which matters because RUNE's economic model already balances liquidity provider yield against staking demand. A sudden supply bump would have repriced both sides.
The trade-off is speed. Revenue-based repayment is gradual. Affected users get made whole over months rather than days. For lenders and liquidity providers who had capital frozen at the halt, that is a real cost: opportunity cost on parked capital, plus the uncertainty of waiting on protocol throughput to recover.
Validator vote is the next gate
The plan still needs validator approval. THORChain governance routes major decisions through node operators, and a recovery framework that touches treasury allocation is exactly the kind of decision they get to weigh. A rejection or major amendment is possible, and the published proposal reads more like a starting point than a final settlement.
There is a second open question: where the exploited funds went and whether any portion is recoverable. THORChain's earlier May 15 incident response flagged a suspected multichain exploit across BTC, ETH, and BNB Chain routes, but did not pin down a final loss figure. Until the forensic accounting is settled and any clawback options are explored, the size of the gap the proposal needs to close stays imprecise.
For now, the headline commitment is the relevant one. Holders read "no new RUNE" as the cleanest possible outcome from a bad situation. Affected users read "revenue-based repayment" as a longer wait. Both readings are correct.
The no-mint choice matters beyond THORChain
DeFi has a fresh case study on offer. Two paths are now visible in 2026. Some protocols, faced with exploit losses, have leaned on token issuance to plug holes and accepted the dilution cost. Others, including THORChain here, are choosing patience and protocol revenue. Which approach holds up better over the next 12 months will shape how other teams design their own incident response playbooks.
The decision also lands during a period where token supply discipline is back in focus. Several large-cap tokens have seen unlocks and emission debates dominate price action in 2026, and any protocol that adds discretionary mints to its issuance schedule risks getting marked down on that basis alone. THORChain's choice keeps it on the disciplined side of that line.
Non-custodial bridges sit in an awkward middle position: they need to be trusted enough that users route real volume through them, but they also need to be honest about the residual smart-contract and validator risk that comes with cross-chain routing. The recovery posture matters as much as the bug fix.
Overview
THORChain proposed a recovery plan on May 22 for the May 15 multichain exploit that ruled out minting new RUNE. Affected users will be repaid through protocol revenue and existing reserves, a slower path that avoids token dilution. The proposal still needs validator approval, and the exact size of the gap is not yet final. The decision lands into a soft market (BTC down 4.3% on the week, Fear & Greed at 39) where additional supply pressure on RUNE would have compounded the damage. The case adds a fresh data point to the broader DeFi debate over how to absorb exploit losses without forcing the cost onto every token holder.
