Thorchain DEX Hack

Thorchain Bifrost component was exploited through the ETH Router contract, resulting in the loss of various tokens including 966.62 ALCX, 20,866,664.53 XRUNE, 1,672,794.010 USDC, 56,104 SUSHI, 6.91 YFI, and 990,137.46 USDT.

The attacker created a fake router and emitted a deposit event by sending ETH. They then passed returnVaultAssets() with a small amount of ETH, but the router was defined as an Asgard vault. On the Thorchain Router, it forwarded ETH to the fake Asgard.

This action created a fake deposit event with a malicious memo. Thorchain Bifrost interpreted this as a normal deposit and refunded to the attacker due to a bad memo definition.

The attacker's address:

https://etherscan.io/address/0xd95e6eab…982072#tokentxns

The transaction behind the attack:

https://etherscan.io/tx/0x9db403ad…4f564b

Other relevant addresses:

Router: https://etherscan.io/address/0xc145990e…a8c2ce

Vault: https://etherscan.io/address/0xf56cba49…36e370

Attack contract: https://etherscan.io/address/0x700196e2…658805

Attack wallet (spawned from Tornado Cash): https://etherscan.io/address/0x8c1944fa…f76d62