What happened
On July 22, 2021, an attacker abused THORChain's Ethereum deposit observation and refund logic. Rekt's reproduction of Halborn's analysis reported approximately $8 million in affected assets. A fake deposit event with an invalid memo triggered a refund to the attacker.
Technical root cause
Improper handling of deposit events allowed fabricated deposits to trigger refunds.
How it happened
- The attacker deployed a fake router and invoked
returnVaultAssetswith a small ETH payment and a malicious vault destination. - The destination produced a fabricated deposit event with a malformed memo.
- Bifrost treated the event as a normal deposit.
- The invalid memo triggered a refund to the attacker, releasing assets against the fabricated deposit.
Protocol details
Classification
Protocol Logic / Exchange (DEX)
Protocol Type
DEX
Category
Bridge Hack
Affected asset / contract
RUNE
Implementation language
Solidity
Protocol links
Website
@thorchain
Security review history
- CertiK View report
Evidence
- report Post-mortem rekt.news
- report Post-mortem medium.com
- report Post-mortem rekt.news
- report THORChain - REKT 2 rekt.news
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
