Bridge Incident Registry
Incident case

THORChain 2021 ETH Router exploit 1

In July 2021, an attacker used a contract positioned in front of THORChain's ETH Router to make Bifrost report deposits that had not actually been received, ultimately draining ETH and contributing to protocol insolvency.

reviewedcurrent

Incident facts

Incident title
THORChain 2021 ETH Router exploit 1
Bridge
THORChain
Incident date
2021-07-15
Incident type
Exploit
Major incident
Yes
Affected chains
THORChain, Ethereum
Affected assets
ETH
Attack category
Cross Chain Contract Exploit
Reported loss
$8 million official estimate; $5 million secondary estimate
Recovery
Unknown
Reimbursement
Completed
Restart
Reopened
Current outcome
Active After Incident
Resolution
Final outcome known
Last reviewed
2026-07-28
Last verified
2026-07-28

Timeline events

  • First THORChain ETH Router exploit disclosed2021-07-15

    THORChain halted the network after the first July 2021 ETH Router incident.

    Exploit DisclosedHigh

  • Treasury coverage and staged recovery plan announced2021-07-30

    The official postmortem assigned liquidity-provider losses to treasury coverage and described a staged recovery and reopening plan.

    Recovery Plan AnnouncedHigh

  • THORChain returned to staged trading after 2021 remediation2021-10

    THORChain returned to staged trading after the July exploit response and protocol hardening work; this event links the shared operational restart to the first ETH Router incident.

    Bridge ReopenedHigh

  • THORChain reported 2021 exploit users fully reimbursed2022-05-11

    THORChain stated that after the chain restarted, liquidity providers and node operators affected by the 2021 exploits were fully reimbursed approximately 16 million dollars in aggregate.

    Reimbursement CompletedHigh

Evidence records

Known unknowns