Rujira Exploit on THORChain: $200K CCL Skew Flaw and What LPs Should Do

Quick answer: Rujira, the app layer built on THORChain's CosmWasm environment, lost about $200,000 on November 10, 2026 when an attacker abused a flaw in the skew math of its Custom Concentrated Liquidity (CCL) positions on the BTC/USDC market. Node operators halted the app layer, Rujira pledged full reimbursement, and an upgraded FIN contract is being prepared before trading resumes.

What happened in the Rujira exploit

Rujira is an application layer that runs on THORChain's CosmWasm smart-contract environment. Its trading product, Rujira Trade, is an order book built on a contract called FIN. Liquidity providers can place Custom Concentrated Liquidity (CCL) positions, which provide liquidity within price ranges they choose.

On the evening of November 10, 2026, abnormal activity appeared on the BTC/USDC market: a sharp price spike and heavy order-book trading. SlowMist's hacked incident list records the event as "Rujira AMM Strategies", dated November 10, with a loss of $200,000 classified as a smart contract vulnerability.

A technical write-up by PandaSecurity on dev.to, published November 12, breaks the loss down: about $175,000 came from positions run by Liquidy Finance and about $25,000 from other users.

Timeline

• November 10 (evening): Abnormal BTC/USDC price movement and trading appear on Rujira Trade.
• November 11: Rujira confirms the exploit, estimates the loss, pledges full reimbursement, and node operators halt the CosmWasm app layer.
• November 12: Rujira says an upgraded FIN contract is nearly ready and targets resuming the app layer the following week, after an audit and new monitoring are in place.

Why it happened: the skew math flaw

According to the dev.to analysis, the root cause was a flaw in the skew calculations used by CCL ranges. Skew controls how a position distributes liquidity across its price range. The flaw let the attacker push existing BTC/USDC positions out of balance and then trade against them at favorable prices.

This was a pricing-logic bug, not a case of someone bypassing permissions. The attacker did not need to steal keys or take over an admin role. They used the contract as written, in a way the math did not anticipate.

The same analysis notes that a FailSafe audit of FIN v2.1.1 contained a medium-severity finding about linear skew mispricing that was marked as resolved. Whether that finding is the same bug exploited on November 10 has not been confirmed.

Not the first Rujira incident

This is Rujira's second app-layer incident in about seven weeks. TokenPost reported on October 20 that a separate FIN exploit, reported on September 26, used a position-transfer flaw to move a CCL position the attacker did not own. That earlier incident hit a single team-held position, with no user funds lost, and was fixed in THORChain v3.21.

Who is affected

• Users with CCL positions on Rujira's BTC/USDC market, especially those whose positions were managed through Liquidy Finance.
• All Rujira users, because trading, lending and range management are unavailable until the app layer resumes.
• THORChain base-layer users are not directly affected. Native swaps on THORChain's base layer kept running because only the CosmWasm app layer was halted.

What Rujira is doing about it

Rujira has said affected users will be reimbursed in full. On November 12, it said the upgraded FIN contract was almost ready. Per the dev.to summary of Rujira's updates, the upgrade:

• Removes the skew parameter entirely.
• Adds CCL stability fixes.
• Restores affected users' CCL positions.

Rujira initially expected recovery within one to two days but now targets resuming the app layer the following week, after an audit and new monitoring are deployed. That monitoring reportedly includes a withdrawal-slowing system called "Gleipnir", designed to limit how fast funds can leave during abnormal activity.

What you should do now

Step 1: Check whether you had a CCL position

Open the official Rujira interface from a bookmark you already trust and review your positions. Note which ranges you held on the BTC/USDC market and their approximate size before November 10.

Step 2: Record your position details

Save your wallet address, the relevant transaction hashes and screenshots of your positions. This will help you confirm that the reimbursement or position restoration is correct.

Step 3: Wait for the official resume announcement

Do not try to interact with the app layer until Rujira confirms it is live again. Transactions during a halt will not process as expected.

Step 4: Verify restored positions after relaunch

When the app layer resumes, compare your restored positions with the records you saved. Raise discrepancies only through Rujira's official channels.

Step 5: Review your wallet permissions

Although this exploit did not rely on token approvals, it is a good moment to review approvals across the chains you use and revoke any you no longer need. Our guide to the Across domain hijack walks through how to revoke approvals step by step.

What to avoid

• Do not send funds to anyone offering to "speed up" reimbursement. No legitimate process requires payment.
• Do not trust attacker addresses or transaction hashes posted by random accounts. No official attacker addresses have been published.
• Do not assume all THORChain activity is paused. Only the app layer was halted. Verify any claims against official THORChain and Rujira channels.

Lessons for DeFi liquidity providers

Concentrated liquidity tools give providers more control and potentially higher fees, but they also add complex math that can fail in edge cases. A few habits help limit exposure:

• Read audit reports and note open or recently resolved findings, especially those about pricing or rounding.
• Size positions with protocol risk in mind. New or recently patched contracts deserve smaller allocations.
• Watch for repeat incidents. Two app-layer incidents in seven weeks is a signal to reassess how much you keep in a single protocol.
• Follow official channels so you hear about halts and fixes directly.

Other recent incidents show similar patterns. The Ankr bridge exploit with forged withdrawals and the Arcus subaccount accounting bug both came down to logic flaws rather than stolen keys. And as our report on a fake AI crypto bot drainer shows, scammers move quickly to exploit headlines like these.

What is still unknown

• The attacker's identity, addresses and transactions.
• The reimbursement mechanism and timing.
• An exact date for the app layer to resume, beyond "next week" after an audit.
• Whether the bug matches the earlier FailSafe audit finding.

Frequently asked questions

Conclusion

The Rujira exploit was a pricing-logic failure in concentrated liquidity math, contained by halting THORChain's app layer while the base layer kept running. If you had CCL positions on BTC/USDC, save your records, wait for the official relaunch and verify your restored positions. Until then, treat every unsolicited refund link as a scam.

This article is for general information only and is not financial or security advice. The Onchain Support is an independent publication and is not affiliated with Rujira, THORChain, Liquidy Finance or any exchange. We will never ask for your seed phrase, private keys, passwords or 2FA codes.