Rujira Trade BTC/USDC CCL strategy on THORChain exploited via skew calculation flaw for about $200k; CosmWasm halted

Summary

Rujira reports that on the evening of 10 November 2026 suspicious activity on Rujira Trade caused a sharp price spike in the BTC/USDC market, followed by a surge in trading across the orderbook. Rujira's investigation indicates that an attacker exploited an issue in the Custom Concentrated Liquidity (CCL) skew calculations, which let them imbalance existing BTC/USDC CCL positions.

Affected

• Rujira Trade BTC/USDC CCL (Custom Concentrated Liquidity) positions on THORChain's CosmWasm app layer
• Fix: per Rujira, the skew parameter will be removed entirely from the contract before the app layer resumes. No fix was deployed at time of publication.

Impact

Per Rujira, the estimated loss is about $200k: roughly $175k from Liquidy Finance's CCL positions and $25k from user funds. Rujira says all losses will be fully reimbursed. THORChain's CosmWasm app layer is halted while Rujira works out the recovery process. Rujira estimated this would take 1-2 days, after which it will ask nodes to resume the app layer. Exploitation is confirmed. Rujira has not published attacker addresses or transactions.

Recommended actions

• Rujira users and CCL liquidity providers: wait for Rujira's official reimbursement and restart announcements; do not act on unofficial "refund" or "claim" links or DMs.
• Integrators: treat Rujira Trade BTC/USDC CCL prices from 10 November 2026 as unreliable, and do not resume dependent activity until Rujira confirms the skew parameter has been removed.

Source & attribution

This 0xCERT advisory summarises Rujira's incident update (https://x.com/RujiraNetwork/status/2120509584553259366), corroborated by SlowMist Hacked (https://hacked.slowmist.io/) and DefiLlama's hacks dataset. Details may change; refer to the original source for the authoritative record.