What happened
THORChain Exploiter 1 Address: Address 0x4b71…bc5a
THORChain Exploiter 2 Wallet: Address 0x3a19…c031
Contract attacker address:
According to ThorChain’s preliminary incident report, the bug was located within the ETH Bifrost (bridge) code:
The code contains an over-ride loop, designed only for use in vaultTransferEvent transactions, which the hacker was able to manipulate. The hacker was able to wrap the router with their own contract, allowing them to access this over-ride.
The attacker drained liquidity in various coins:
- 2,500 ETH
- 57,975.33 SUSHI
- 8.7365 YFI
- 171,912.96 DODO
- 514.519 ALCX
- 1,167,216.739 KYL
- 13.30 AAVE
Ether were sent to the external address:
Protocol details
Classification
Protocol Logic / Exchange (DEX) / Bridge & Cross-Chain
Protocol Type
DEX
Category
Bridge Hack
Affected asset / contract
RUNE
Implementation language
Solidity
Protocol links
Website
@thorchain
Security review history
- CertiK View report
Evidence
- report Post-mortem rekt.news
- report Post-mortem rekt.news
- analysis Website reference thearchitect.notion.site
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
