Thorchain suffers $5 million exploit, developers have put out a fix

Cross-chain exchange Thorchain suffered a $5 million exploit on Friday. Since the attack, developers have put out an emergency release to fix the bug and have promised the treasury will be used to make the liquidity providers whole.

The exploit was announced around 10:23 UTC, with initial reports estimating the size of the hack at around 13,000 ETH ($24 million), before this was revised to around 4,000 ETH ($7.4 million), and then later to around $4.9 million. The funds taken were in ether and Ethereum-based tokens.

"This is a disappointing moment for all, but LPs and Nodes should be unaffected after all is recovered (the funds will be restored)," tweeted the official Thorchain account.

Thorchain is a protocol for swapping native assets, such as bitcoin and ether, between different blockchains but without wrapping them as tokens on other chains. Its "chaosnet" is effectively a cross-chain decentralized exchange. Thorchain is used by exchanges such as ShapeShift, which is going fully decentralized.

Halting the network

When the attack was noticed, nodes running the network halted it, preventing the attack from getting worse. The threshold to halt the network is a third of the 38 nodes running it.

Since the bug was found, Thorchain's developers have already put out a fix and are encouraging node operators to update their software.

After the exploit occured, YFI's Andre Cronje tweeted, "Innovation leads to exploitation. Its why hardened protocols often stop innovating, very little upside to increase risk by innovating. Its why we also see more exploits in new developing sectors."

The price of Thorchain's native token RUNE has since dropped 18%, falling to its current price of $4.77.