THORChain Suffers Another Exploit

Please see updates below. Orignial loss was estimated at 13,000 ETH, but is now estimated to be 2,500 ETH. The discrepancy may be due to additional loss from arbitrageurs taking advantage of the price manipulation. The original title and image for this article have been revised.

THORChain has suffered another unfortunate exploit — the second this month — as hackers drained 13,000 worth of ETH from the network.

Developers have already assured users that the treasury has the funds to cover the loss, but requests that the attacker contact them to discuss returning the funds in exchange for a bounty.

The network has been halted while the developers investigate the extent of the exploit and how to patch the vulnerability.

‍

Update #1: Quick Post-Mortem

‍

Update #2: Original 13k ETH estimated loss revised to 4k ETH

‍

Update #3: Tweet thread describing the attack vector:

‍

Update #4: THORChain Announcement states exploited amount is $4.9mm

‍

Update #5: Vulnerability has been identified and is being patched

‍

Update #6: Large fee paid by hacker will profit LPs and node operators

‍

Update #7: Multi-phase approach to resuming the network has been outlined.

View the full tweet thread for an in-depth breakdown of the process.

‍

Update #8: Proposals for the Treasury

‍
A series of proposals have been created by the community outlining the different possibilities for rectifying the network’s insolvency.

Read about them here: https://www.runebase.org/news/summary-of-thorchain-treasury-proposals

‍

Update #9: Return to Solvency

The team has outlined a plan to return the network to solvency.

‍

‍This is a developing story. Updates will be posted here.