With the emergence of cryptocurrencies, also came a corresponding rise in ransomware attacks. Several security loopholes in the cryptocurrency space in general, and smart contract platforms in particular, have come to light over the last few years. Once hailed as foolproof, blockchains have fallen fall prey to illicit activities, an assertion evidenced by the numerous scams and fraudulent activities that ensued.<\/p>\n
The latest to fall victim to the same is THORChain, a popular cross-chain decentralized exchange. It’s in the news today after an exploit drained millions of dollars from the network. The community’s Telegram group initially pegged the loss at about 13,000 ETH<\/a> (around $25 million). Later, however, this was revised<\/a> on Twitter, with the project claiming,<\/p>\n “At this stage, the estimate is around ~4000 ETH worth of assets (ETH\/ERC20) was taken, not 13k ETH. More detailed assessment and recovery steps will be announced soon. The users who suffered (LPs) will be made whole in the coming weeks.”<\/p><\/blockquote>\n The fiat equivalent of the same stood at around $7.6 million. On the other hand, as per the THORChain community’s Telegram channel<\/a>, the administrators estimated the illicit hack cost $4.9 million. In addition to this, its members were reassured by the project as well.<\/p>\n “While the treasury has the funds to cover the stolen amount, we request the attacker get in contact with the team to discuss the return of funds and a bounty commensurate with the discovery,” a Telegram post stated<\/a>, adding that user funds “will be available when the issue has been patched and the network resumes.”<\/p>\n How did it happen?\u00a0<\/strong><\/p>\n As per an initial analysis report released by THORChain’s executives in a series of tweets<\/a>,<\/p>\n Initial Assessment. <\/p>\n 1) ETH Bifrost was recently updated to allow the router to be "wrapped" by contracts (to allow composability)https:\/\/t.co\/GXclWbPgP2<\/a> — THORChain (@THORChain) July 16, 2021<\/a><\/p><\/blockquote>\n\n
2) The attacker then tricked the Bifrost by using a custom wrapper contract, when they actually transferred 0 ETH https:\/\/t.co\/TlcNkO9PMj<\/a><\/p>\n