A Bifrost Bridge Flaw Drains $5 Million From THORChain

THORChain became the newest name added to the growing list of cross-chain protocols hit by exploits, losing roughly $5 million across several assets after an attacker found a flaw in recently updated code for its Bifrost bridge.

Commentary from other DeFi builders framed the incident as part of a pattern: Andre Cronje had written that innovation tends to invite exploitation, and recent months had shown attackers increasingly reusing techniques from one protocol's exploit in another, sometimes with only minor changes. THORChain's addition to rekt.news's leaderboard of hacked projects was notable because, unlike some quick forks or copy-paste protocols on that list, THORChain had built a genuinely large following — its market capitalization had reached nearly $5 billion just two months before the attack, and stood at around $1.2 billion at the time of the incident.

The attacker's wallet was identified as 0x3a196410a0f5facd08fd7880a4b8551cd085c031, operating through a contract at 0x4a33862042d004d3fc45e284e1aafa05b48e3c9c, with proceeds later moved to a Tornado Cash address, 0x4b713980d60b4994e0aa298a66805ec0d35ebc5a.

THORChain's own preliminary incident report traced the root cause to the Ethereum Bifrost (bridge) codebase. That code contained an override loop intended to apply only to vaultTransferEvent transactions. By wrapping the router with a contract of their own, the attacker was able to trigger that override outside its intended context.

Mechanically, the attacker submitted a transaction with both a call value and a deposit amount of zero. Because of how the override loop was implemented, the transaction's msg.value — set at 200 — was mistakenly read back as the result of txvalue(). Repeating this in a loop let the attacker drain liquidity across multiple assets:

• 2,500 ETH
• 57,975.33 SUSHI
• 8.7365 YFI
• 171,912.96 DODO
• 514.519 ALCX
• 1,167,216.739 KYL
• 13.30 AAVE

What stood out to observers was that the vulnerable section of code already carried a warning comment — "it is important to keep this part outside the above loop" — that had evidently gone unheeded. THORChain's incident report concluded that the proper fix was to restrict the override so it would trigger only for genuine vaultTransferEvent transactions, something the team apparently could have caught earlier.

The exploit arrived at a time when building a secure cross-chain bridge was seen as one of DeFi's most valuable open problems, with multiple major protocols racing to ship their own — Aave, for instance, had signaled it would launch a bridge of its own soon. If exploitation really does follow innovation as closely as this incident suggests, more such stories seemed likely to follow.