A malicious node operator exploited a GG20 signature vulnerability, draining ~$10.7M from THORChain. Auto-safeguards halted trading.