-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0343
============================================================

Advisory-ID:  0xCERT-2026-0343
Severity:     Medium
Published:    2026-11-11T13:30:56.000Z
Updated:      2026-11-12T08:43:18.917Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0343

Title: Rujira Trade BTC/USDC CCL strategy on THORChain exploited via skew calculation flaw for about $200k; CosmWasm halted

Summary
- -------
An attacker exploited a flaw in the skew calculations of Rujira Trade's BTC/USDC Custom Concentrated Liquidity (CCL) strategy on THORChain on 10 Nov 2026, taking about $200k. THORChain's CosmWasm app layer is halted. Rujira says it will reimburse all losses and remove the skew parameter.

Details
- -------
Summary
Rujira reports that on the evening of 10 November 2026 suspicious activity on Rujira Trade caused a sharp price spike in the BTC/USDC market, followed by a surge in trading across the orderbook. Rujira's investigation indicates that an attacker exploited an issue in the Custom Concentrated Liquidity (CCL) skew calculations, which let them imbalance existing BTC/USDC CCL positions.

Affected
- - Rujira Trade BTC/USDC CCL (Custom Concentrated Liquidity) positions on THORChain's CosmWasm app layer
- - Fix: per Rujira, the skew parameter will be removed entirely from the contract before the app layer resumes. No fix was deployed at time of publication.

Impact
Per Rujira, the estimated loss is about $200k: roughly $175k from Liquidy Finance's CCL positions and $25k from user funds. Rujira says all losses will be fully reimbursed. THORChain's CosmWasm app layer is halted while Rujira works out the recovery process. Rujira estimated this would take 1-2 days, after which it will ask nodes to resume the app layer. Exploitation is confirmed. Rujira has not published attacker addresses or transactions.

Recommended actions
- - Rujira users and CCL liquidity providers: wait for Rujira's official reimbursement and restart announcements; do not act on unofficial "refund" or "claim" links or DMs.
- - Integrators: treat Rujira Trade BTC/USDC CCL prices from 10 November 2026 as unreliable, and do not resume dependent activity until Rujira confirms the skew parameter has been removed.

Source & attribution
This 0xCERT advisory summarises Rujira's incident update (https://x.com/RujiraNetwork/status/2120509584553259366), corroborated by SlowMist Hacked (https://hacked.slowmist.io/) and DefiLlama's hacks dataset. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/RujiraNetwork/status/2120509584553259366
- - https://hacked.slowmist.io/
- - https://defillama.com/hacks

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0Fgmr1vtcJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcSsSdGMO98L7K6LiUEoxtO7t6+rQ5C1Z0WTrPo
t1AnZhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAA2dwEA/lbGbQl7msx0efFa
iN9nqMg9J/yHSs+hvlJ38vPLWmgA/282AjKkN6ZksrMlk87YaUOBbZTQCob9
8GOazfoj/l0E
=3qe2
-----END PGP SIGNATURE-----