Thorchain DEX Hack

TOTAL LOST $5.0M
Medium Over-ride Logic Exploit ethereum

What happened

THORChain Exploiter 1 Address: https://etherscan.io/address/0x4b713980…5ebc5a

THORChain Exploiter 2 Wallet: https://etherscan.io/address/0x3a196410…85c031

Contract attacker address:

https://etherscan.io/address/0x4a338620…8e3c9c

According to ThorChain’s preliminary incident report, the bug was located within the ETH Bifrost (bridge) code:

https://gitlab.com/thorchain/thornode/-/blob/develop/bifrost/pkg/chainclients/ethereum/ethereum_block_scanner.go#L794

The code contains an over-ride loop, designed only for use in vaultTransferEvent transactions, which the hacker was able to manipulate. The hacker was able to wrap the router with their own contract, allowing them to access this over-ride.

The attacker drained liquidity in various coins:

- 2,500 ETH

- 57,975.33 SUSHI

- 8.7365 YFI

- 171,912.96 DODO

- 514.519 ALCX

- 1,167,216.739 KYL

- 13.30 AAVE

Ether were sent to the external address:

https://etherscan.io/address/0xace2d948…bc470e

Case & protocol details

Classification Protocol Logic / Exchange (DEX) / Bridge & Cross-Chain
Protocol Type DEX
Affected asset / contract RUNE
Smart Contract Language Solidity
Official Website thorchain.org/
Protocol Twitter/X @thorchain

Security review history

Evidence & learning

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes