THORChain Exploited for $5 Million in Latest DeFi Attack

Share Article
In Brief
  • Cross-chain DEX loses $5M in Bifrost exploit.

  • It's the second time THORChain has been hacked.

  • RUNE prices dump 19% on the day.

  • promo

    KuCoin Releases KCS whitepaper – a Path for Geek to Mass Adoption Read now!

The Trust Project is an international consortium of news organizations building standards of transparency.

Cross-chain decentralized exchange (DEX) THORChain has been added to the lengthening list of exploited protocols as details emerge of a multi-million dollar hack.

In an announcement on July 16, THORChain estimated that it had lost around 4,000 ETH. Previously, estimates were as high as 13,000 ETH lost in the attack. In a post on the platform’s Telegram channel, THORChain stated that the actual loss was approximately $4.9 million, adding it was, “far less than the initial figures posted earlier.”

Details are thin on the ground but THORChain stated that a more detailed assessment and recovery steps will be announced soon.

According to Runebase, a guide dedicated to the DEX protocol, the Multi-Chain ChaosNet (MCCT) which was launched in April was halted upon the discovery of the exploit. It added that developers have already assured users that the treasury has the funds to cover the loss. They have requested the attacker contact them to discuss returning the funds in exchange for a bounty.

Bifrost blamed

An incident report blamed a bug in Bifrost, a DeFi protocol that connects with Polkadot and different proof-of-stake blockchains. It stated that ETH Bifrost was recently updated to allow the router to be “wrapped” by contracts to allow composability. The attacker managed to use this vulnerability to attack the THORChain router and manipulate it.

“ETH Bifrost was tricked using a custom wrapper to read a deposit amount of 200 when it was actually zero.”

THORChain has been scrambling to defend its position amid growing concern among token holders.

“When a centralised exchange is hacked, users don’t find out months later until their withdrawals are blocked or delayed. When THORChain suffers insolvency, everyone immediately knows. Which do you prefer?”

ShapeShift CEO Erik Voorhees was one of them, but he lamented on his loss while remaining upbeat:

“Lost a bunch on my RUNE position today. Worth it. We’re in this for the long-term. Cross-chain decentralized trading with no intermediaries is worth a great many stumbles. Expect chaos during chaosnet.”

THORChain stated that liquidity providers and nodes should be unaffected after the funds have been recovered and restored, adding “the network will be stronger and more resilient.”

Today’s attack is the second time THORChain has been targeted by hackers during its Chaosnet deployment as it lost around $140,000 in an attack in June.

RUNE price tanks

Unsurprisingly, THORChain’s native token has tanked almost 20% from an intraday high of $5.86 to around $4.75 before a minor recovery over the last couple of hours.

According to CoinGecko, RUNE is trading 76% down from its mid-May all-time high of $20.90.


All the information contained on our website is published in good faith and for general information purposes only. Any action the reader takes upon the information found on our website is strictly at their own risk.
Share Article

Martin has been covering the latest developments on cyber security and infotech for two decades. He has previous trading experience and has been actively covering the blockchain and crypto industry since 2017.

Follow Author

KuCoin Releases KCS whitepaper – a Path for Geek to Mass Adoption      

Read now Startup – Leading Blockchain Project Discount Platform for Startups

Read now

Olympus, a P2E NFT Game Similar to Clash Royale, Is Making Headlines

Read Now