THORChain's Second Exploit in Ten Days Costs the Protocol Another $8 Million

Just over a week after losing $5 million to a Bifrost bridge exploit, THORChain was struck again — this time for roughly $8 million. The attacker reportedly left a message hinting at the nature of the incident, but it was initially misread: THORChain's team first believed only around $800,000 had been lost, and to a whitehat actor returning funds voluntarily, before the on-chain transaction data made clear the loss was far larger.

Throughout, THORChain's official Twitter account maintained its usual conversational, informal tone even after the second attack — a choice that read differently to a community watching over $10 million in user funds disappear within ten days. One RUNE holder sent the attacker a pointed on-chain message during the fallout, drawing a one-word reaction from onlookers: "Savage."

According to an analysis credited to Halborn Security, the attack was first observed on July 22, 2021 at 21:42 GMT, and targeted THORChain's Bifrost component through its ETH Router contract. The addresses involved were:

• Router: 0xc145990e84155416144c532e31f89b840ca8c2ce
• Vault: 0xf56cba49337a624e94042e325ad6bc864436e370
• Attack contract: 0x700196e226283671a3de6704ebcdb37a76658805
• Attack wallet (funded via Tornado Cash): 0x8c1944fac705ef172f21f905b5523ae260f76d62

The mechanism worked as follows: the attacker deployed a fake router contract and generated a deposit event by sending ETH. They called returnVaultAssets() with a small ETH amount, but the router was misidentified as a legitimate Asgard vault. THORChain's real router then forwarded ETH to this fake Asgard address, generating a fraudulent deposit event carrying a malicious memo. THORChain's Bifrost component treated this as an ordinary deposit and, because of how it handled an invalid memo, issued a refund directly to the attacker.

Six transactions tied to the attack were identified: 1, 2, 3, 4, 5, and 6, with a final attacker transaction recorded separately.

THORChain transactions carry user intent through a MEMO field, which the protocol inspects alongside the transaction object itself before processing; when a memo is invalid, THORChain automatically issues a refund, per its own documentation. This exploit specifically targeted that refund logic, a failure researchers characterized as a lack of proper multi-event handling. The total impact came to roughly $8 million, made up of:

• 966.62 ALCX
• 20,866,664.53 XRUNE
• 1,672,794.010 USDC
• 56,104 SUSHI
• 6.91 YFI
• 990,137.46 USDT

RUNE's price fell 25% in the aftermath, but a second, unrelated problem soon emerged. A vulnerability rooted in earlier developer decisions was found in the RUNE token contract itself. Hours after the attack, wallets began receiving an unfamiliar token called UniH; anyone who tried to sell it and approved its use had their entire RUNE balance drained as a result. The root cause was that RUNE's transferTo function relied on tx.origin rather than msg.sender — a pattern Solidity's own documentation explicitly warns against, since it lets malicious contracts move a user's RUNE simply by having that user interact with them. One recorded transaction shows exactly this: approving UniH for spending was enough to trigger a full RUNE drain. Code comments indicated the development team had anticipated this exact issue and had labeled the pattern "non-standard" rather than fixing it — an observation credited to Mudit Gupta.

Two exploits in the span of ten days left THORChain, a well-regarded if not top-tier DeFi project, facing serious questions about its security practices. Notably, the attacker walked away with only a fraction of the roughly $8 million they could have taken, leaving most of the funds behind — a detail that led some to conclude the motive behind the second attack was less about profit and more about demonstrating power.