Thorchain Tapping Treasury to Repay $5M in Ethereum After Attack

Thorchain, a “decentralized liquidity protocol” for trading crypto across different blockchains, promised via Twitter that users affected by a $5 million hack yesterday would be fully compensated.

“The only entity that will wear [sic] the burden will be the THORChain treasury, approx $5m will be used to donate to ETH LPs,” it wrote late on Thursday evening, hours after the attack.

The only entity that will wear the burden will be the THORChain treasury, approx $5m will be used to donate to ETH LPs.

This is the purpose of the treasury during Chaosnet, to insure the network funds.

Onwards

— THORChain #ACTIVATETHESYNTHS (@THORChain) July 16, 2021

The network was paused by nodes on Thursday after it was discovered that roughly 13,000 Ethereum ($25 million) had been taken via an attack. Thorchain later took to Twitter (and then its Telegram channel) to downgrade that figure to approximately $7.6 million in Ethereum and ERC20 tokens, which are tokens that run on the Ethereum blockchain. In a later Telegram post, it again revised the total, this time to $4.9 million.

According to a pinned post on Thorchain’s Telegram channel, a full post-mortem of the exploit is coming. In the meantime, it has said that the attacker was able to trick the protocol’s bridge to the Ethereum blockchain, known as ETH Bifrost (in keeping with the Norse mythology theme), that they had transferred in ETH when they hadn’t.

Thorchain falls under the broad umbrella of decentralized finance (DeFi), the term for blockchain-based software that removes intermediaries from financial activities such as lending, earning interest, and, in this case, trading assets. It is built atop the Cosmos network, which enables disparate blockchains to share data with each other.

According to Thorchain, liquidity providers, or LPs, were the only users affected. LPs are users who take the cryptocurrency they hold—Thorchain’s native RUNE—and deposit it with the network. The network can then use those funds to facilitate trades, while LPs get a cut of the action.

In this case, however, liquidity providers got wet.

It’s not the first time Thorchain has been attacked. In late June, an attacker made off with $140,000 in Ether and ERC20 tokens after a “logic error in the ETH Bifrost.”

Thorchain devs seem unfazed, saying this is precisely why it has a treasury in place. It’s all just part of its Chaosnet, which went live in mid-April. The Multchain Chaosnet, or MCCN for short, allows people to swap assets across five different blockchains: Binance Chain, Bitcoin, Bitcoin Cash, Ethereum, and Litecoin.

Chaosnet is not a mainnet per se, but more like a sandbox as Thorchain works to strengthen the protocol.

Thorchain says after patching and restarting the network, treasury funds will go back into the ETH liquidity pool.

“This is a disappointing moment for all, but LPs and Nodes should be unaffected after all is recovered (the funds will be restored),” said Thorchain. “The network will be stronger and more resilient.”

17 July 2021 00:25