IoTeX Bridge Hack Drains $8M in Crypto
A security breach on the IoTeX network's bridge resulted in an $8 million loss due to a compromised private key. Attackers exploited access to the bridge's smart contract, draining funds and reigniting concerns over the security of cross-chain bridges and private key management protocols. In response, IoTeX acknowledged the incident but disputed the total loss amount. The exploit has prompted a wider industry reevaluation of smart contract security, particularly for cross-chain infrastructure.
- The attack on February 21, 2026, gave the hacker control over IoTeX's TokenSafe and MinterPool contracts, allowing them to drain assets including USDC, USDT, IOTX, PAYG, WBTC, and BUSD. - In addition to draining approximately $4.3 million in assets, the attacker also minted $4 million in CIOTX tokens and $4.5 million in CCS tokens. - IoTeX has since clarified the confirmed loss of liquid assets is closer to $4.4 million and that the team has frozen roughly 86% of the unauthorized tokens that were minted. - To launder the funds, the attacker swapped the various stolen assets for Ethereum (ETH) and then used the THORChain protocol to bridge them to the Bitcoin (BTC) network, making them more difficult to trace. - In the immediate aftermath, IoTeX temporarily paused its blockchain to deploy security upgrades and has committed to releasing a full incident report and a compensation plan for affected users. - The native IOTX token fell by over 9% in the 24 hours following the news of the exploit, while its daily trading volume increased by more than 500%. - This incident highlights a significant vulnerability in the crypto space; in 2022, exploits targeting cross-chain bridges accounted for 64% of all digital currency losses. - IoTeX is collaborating with major exchanges and law enforcement agencies to trace and freeze the stolen assets.
