Thorchain Attack Drains Protocol of Estimated $7.6 Million

Editor’s note: This story has been updated to note the shifting estimates of the attack’s cost.

Thorchain has been struck by an attack that has drained millions in assets from the protocol.

Administrators in the community’s Telegram group initially pegged the loss to the protocol at about 13,000 ETH ($25.1 million) before later taking to Twitter to estimate the attack at “~4,000 worth of assets (ETH/ERC20).” That would downgrade the attack’s severity to just over $7.6 million at today’s prices. It’s unclear whether the social media accounts are run by the same people.

“While the treasury has the funds to cover the stolen amount, we request the attacker get in contact with the team to discuss return of funds and a bounty commensurate with the discovery,” network administrators wrote in the community’s Telegram group.

It continued by saying that users’ funds “will be available when the issue has been patched & the network resumes.” In the meantime, it said, “The network has been halted.”

Thorchain is a protocol for trading crypto assets, such as Bitcoin and Ethereum, across different blockchains without using a middleman. It does this by including its native token, RUNE, in every trade. To go from Bitcoin to Ethereum, for example, you would swap BTC for RUNE, then RUNE for ETH.

Though the double-swap adds an extra step, it helps ensures that Thorchain remains decentralized. Decentralized finance, or DeFi, is the catchall term used for blockchain-based protocols that can do complex financial transactions like loans and swaps without intermediaries.

Just because it’s decentralized, however, doesn’t mean Thorchain can’t be temporarily shut down. Tonight’s Twitter post promised that a “more detailed assessment and recovery steps will be announced soon.

15 July 2021 22:31