{
  "id": "rujira-ccl-skew-exploit",
  "url": "https://ohshit.app/incidents/rujira-ccl-skew-exploit/",
  "title": "Rujira pauses its app layer after exploitation of BTC/USDC liquidity positions",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-11",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Rujira",
    "THORChain",
    "DeFi"
  ],
  "ecosystems": [],
  "summary": "Rujira says an attacker exploited the skew calculation in its BTC/USDC concentrated liquidity strategy. It estimates about $200,000 in losses and plans to reimburse affected positions. CosmWasm is paused during recovery.",
  "splash": "Existing BTC/USDC custom concentrated liquidity positions on Rujira Trade, including positions held by Liquidy Finance.",
  "wipe": "Pause affected automation and verify the official restart and reimbursement instructions before acting.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Pause affected automation and reconcile your position",
      "hint": "Suspend order, liquidity and position jobs that depend on the affected app layer. Record positions, balances, wallet addresses and transaction hashes for reconciliation."
    },
    {
      "title": "Verify restart and reimbursement through Rujira",
      "hint": "Check Rujira’s official channels for the contract change, restart and reimbursement instructions. Keep seed phrases and private keys private. Ignore unsolicited claim links and signature requests."
    },
    {
      "title": "Reconcile before re-enabling integrations",
      "hint": "After an official restart, check the deployed strategy configuration and affected balances before re-enabling automation. Compare any posted reimbursements with your own records."
    }
  ],
  "sources": [
    {
      "name": "Rujira incident update, public copy",
      "url": "https://www.teapawt.org/RujiraNetwork/status/2120509584553259366",
      "says": "Records the observed trading, affected strategy, loss estimate, pause and planned recovery.",
      "primary": true
    },
    {
      "name": "Rujira strategy documentation",
      "url": "https://docs.rujira.network/strategies",
      "says": "Explains CCL and how its skew parameter affects orders.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Rujira confirms exploitation of the BTC/USDC liquidity strategy.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 10, 2026",
      "title": "Suspicious trading appears on Rujira Trade",
      "body": "Rujira reports a BTC/USDC price spike and a burst of order book activity."
    },
    {
      "date": "Nov 11, 13:30 UTC",
      "title": "Rujira confirms exploitation and describes the pause",
      "body": "The project attributes the imbalance to the CCL skew calculation. It says CosmWasm is halted and outlines a contract change and reimbursement."
    }
  ],
  "body_markdown": "CCL lets liquidity providers concentrate funds within a selected price range. The skew parameter determines how liquidity is distributed within that range. Rujira says a flaw in that calculation let the attacker push existing BTC/USDC positions out of balance. [Official post](https://x.com/RujiraNetwork/status/2120509584553259366)\n\nThe project estimates about $175,000 in losses from Liquidy Finance’s CCL positions and about $25,000 from other user funds. These are project estimates. Rujira says it plans to reimburse all losses and remove the skew parameter from the contract, then ask THORChain nodes to resume the app layer. The published estimate of one to two days is a recovery target. The reviewed disclosures provide no completed payouts, fixed release or confirmed restart time."
}