Thoreum Finance Hack

REPORTED LOSS $580K
Low Access Control bsc

What happened

The Thoreum Finance protocol was exploited due to the private key leaking.  Estimated losses are about $580,000 USD.

The Thoreum Finance protocol was exploited, most likely it was an access control issue. Thus, the explorer had the ability to redeploy the proxy contract implementation with malicious logic inside. Approximately 500,000 THOREUM tokens were minted and swapped to WBNB.

After that funds were transferred through tornado cash mixer.

Attacker address:

https://bscscan.com/address/0x1ae2dc57…006f99

Attack tx:

https://bscscan.com/tx/0x5058c820…e18331

Tornado cash transfers:

https://bscscan.com/txs?a=0x1285fe34…d2e35c

Case & protocol details

Classification Other / Protocol Logic
Protocol Type Yield
Affected asset / contract THOREUM
Implementation language Solidity
Official Website thoreum.capital/
Protocol Twitter/X @ThoreumFinance

Security review history

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.