THORChain 2021 ETH Router exploit 1
In July 2021, an attacker used a contract positioned in front of THORChain's ETH Router to make Bifrost report deposits that had not actually been received, ultimately draining ETH and contributing to protocol insolvency.
Incident facts
- Incident title
- THORChain 2021 ETH Router exploit 1
- Bridge
- THORChain
- Incident date
- 2021-07-15
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- THORChain, Ethereum
- Affected assets
- ETH
- Attack category
- Cross Chain Contract Exploit
- Reported loss
- $8 million official estimate; $5 million secondary estimate
- Amount confidence
- Medium
- Loss amount basis
- Official Postmortem Prioritized, With Lower Secondary Estimate Retained As A Conflicting Claim
- Recovery
- Unknown
- Reimbursement
- Completed
- Restart
- Reopened
- Current outcome
- Active After Incident
- Postmortem
- Full
- Resolution
- Final outcome known
- Last reviewed
- 2026-07-28
- Last verified
- 2026-07-28
Amount and valuation
THORChain's official postmortem reported an $8 million impact and about 4,200 ETH siphoned; Rekt reported approximately $5 million in assets taken.
Use the official $8 million figure as canonical while retaining the $5 million secondary estimate because contemporary public estimates differed.
approximately 4,200 ETH siphoned$8 million impact
Canonical display amount.
various assets takenabout $5 million
Retained as a lower contemporary estimate.
Timeline events
First THORChain ETH Router exploit disclosed2021-07-15
THORChain halted the network after the first July 2021 ETH Router incident.
A lower contemporary estimate of about $5 million is retained in the incident amount claims.
Treasury coverage and staged recovery plan announced2021-07-30
The official postmortem assigned liquidity-provider losses to treasury coverage and described a staged recovery and reopening plan.
This shared recovery plan covers both July 2021 incidents.
THORChain returned to staged trading after 2021 remediation2021-10
THORChain returned to staged trading after the July exploit response and protocol hardening work; this event links the shared operational restart to the first ETH Router incident.
The same operational restart period also applies to the second July 2021 ETH Router incident.
THORChain reported 2021 exploit users fully reimbursed2022-05-11
THORChain stated that after the chain restarted, liquidity providers and node operators affected by the 2021 exploits were fully reimbursed approximately 16 million dollars in aggregate.
The official aggregate amount is not split between the two July incidents.
Evidence records
- Post-Mortem: ETH Router Exploits 1 & 2, and Premature Return to Trading IncidentTHORChain · Tier 1 · High reliability · primary · 2021-07-30Claim scope: Incident Case
Primary postmortem for both July 2021 incidents and the recovery plan.
- THORChain - REKTRekt · Tier 3 · Medium reliability · secondary · 2021-07-16Claim scope: Amount
Contemporary secondary account retained for the lower approximately $5 million estimate.
- THORChain's Layers of SecurityTHORChain · Tier 1 · High reliability · primary · 2022-05-11Claim scope: Restart
Primary retrospective source confirming that the chain restarted after the 2021 incidents.
- THORChain's Layers of SecurityTHORChain · Tier 1 · High reliability · primary · 2022-05-11Claim scope: Reimbursement
Incident-scoped evidence for the combined approximately $16 million reimbursement statement.
- Post-Mortem: ETH Router Exploits 1 & 2, and Premature Return to Trading IncidentTHORChain · Tier 1 · High reliability · primary · 2021-07-30Claim scope: Recovery
Event-scoped duplicate of bir_src_000040: the primary postmortem assigns losses to treasury coverage and describes the staged recovery and reopening plan; the original record remains incident-scoped to bir_ev_000029.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The exact realized dollar loss depends on valuation timing and whether later operational insolvency effects are included.
Conflicting claims
Direct incident loss estimate
Reported values: $8 million official impact estimate · Approximately $5 million secondary estimate
Current treatment: Use the official $8 million estimate as canonical and retain $5 million as the lower contemporary estimate.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.