Rujira Trade: tracing 108 ETH and two USDT paths
November 14, 2026
Rujira reported about $200,000 in losses from its BTC/USDC market on November 10. It attributed the incident to the strategy that controls how liquidity is distributed across prices. This report follows subsequent payments from the THORChain account identified by Arisk and tests how much of two later USDT transfers can be assigned to incident proceeds. Rujira disclosure · Arisk investigation
Ten THORChain payouts match Ethereum receipts
A cross-chain swap starts on one network and pays out on another. We matched the Ethereum payout hash from each of ten THORChain actions to the amount and recipient in the Ethereum execution history. Together the ten payouts credited 108.08227778 ETH. The two largest drew on secured BTC and secured USDC, which are representations of those assets on THORChain. The receipts measure gross payouts and leave the original capital and incident proceeds mixed.
What reached each destination?
Figure 1. The figure shows the original trace. The section below records the subsequent verification of the Tron connection. Amounts measure different stages and should be read separately.
The 3.42 ETH Ethereum transaction prefunded an execution step. The next transaction consumed that prefunding under the same witness and emitted Across deposit 91d22ac5eb67f840fdac8415722683ee5e5e4e25423bf12336bd43b645036915 for destination chain 728126428 (Tron). The Tron fill emitted the same deposit ID, Ethereum origin chain ID 1, recipient, and 7,028.840637 USDT output. The subsequent transfer forwarded that amount to the address labeled Binance-Hot 12 by Tronscan. This verifies the complete order-to-payout connection.
Ethereum prefunding · Ethereum settlement · Tron fill · Tron forward
Immediately before the first of the ten matched Ethereum payouts, the source wallet held 266.690249037047632519 ETH at block 26,387,392. Seven visible deposits back to the THORChain router totaled 3.23807419 ETH the next morning. The balances immediately before the Tron prefunding and BNB routing were 372.254428173068301033 ETH and 371.150774106760449981 ETH respectively. The opening balance could cover both route inputs and the intervening observed ETH debits. Its earlier provenance has not been classified. For the two exchange-linked transfers, the supported incident-derived range remains 0 to 12,676.840637 USDT, with no positive minimum established.
On BNB Chain we reconstructed the receiving wallet's earlier balance from its later balance and the USDT transfer logs between them. It already held 17,957.955541724285212864 USDT immediately before the fill. With no intervening USDT transfer before the first send, that earlier balance could cover all 5,648 USDT. Between zero and 5,648 USDT of that send could therefore come from the observed fill. That range concerns bridge provenance. The Ethereum input itself came from a wallet holding over 371 ETH before the routing transaction, so the bridge match does not establish which part came from the incident. A separate 22,598.88 USDT transfer used another recipient and is excluded from the exchange-linked total. Ethereum source · BNB fill · First send · Forward · Separate send
What can be attributed to the incident?
The two observed exchange-linked transfers total 12,676.840637 USDT. No positive incident-derived minimum is established. The conservative gross ceiling for these two transfers is the amount observed, subject to the BNB destination-label limit. To tighten it, we would need a source ledger that isolates incident proceeds from the pre-existing ETH and secured assets. Public transfers do not expose the exchange's internal account credits.
Evidence checked November 14, 2026. Transaction times are UTC.
Explorer links
thor10twjklsmm4e8wnl0e7f2rhtz7urv66yrjjmggk
0x911c3BF11dFc5497A53A7A04Ff7980532516f176
0
05 reads
Become an Investigator
