THORChain Hack #3 - July 2021
Overview
On July 23, 2021, THORChain was hit for the third time, resulting in a loss of nearly $8 million. This was the third exploit in a month, bringing total losses to around $13 million.
Attack Details
The attack was perpetrated against the ETH Router contract to target the Thorchain Bifrost component, resulting in more than $8 million in losses for the protocol. A hacker deployed a custom contract that was able to trick the Bifrost into receiving a deposit of fake assets.
The Hacker's Message
The hacker wanted to teach a lesson — the attack could have been far worse, and made sure to leave a note explaining this. In the transaction's input data, the hacker wrote that they could have taken further coins including bitcoin (BTC), ether (ETH) and BNB, saying there were multiple critical issues and they "wanted to teach lesson (sic) minimizing damage."
Bounty Request
The hacker requested a 10% bounty of the stolen funds and THORChain's treasury had the money to cover the exploit.
Impact
News of the new exploit had a negative impact on the market for RUNE, THORChain's native token, which took a 16.8% hit in the last 24 hours and was down 43% in the last 30 days.
Sources