IoTeX: The attack targeted the Ethereum side contract of the multi-chain bridge ioTube. A detailed compensation plan will be announced within 48 hours.

Techub News reports that the IoTeX team has released an update on the security incident. IoTeX states that the vulnerability affected its multi-chain bridge ioTube’s Ethereum side contract, while bridge contracts on other chains such as BSC and Base were not impacted. Additionally, IoTeX Layer 1, user assets, and exchange assets remain secure.

IoTeX explains that due to a validator wallet leak, an attacker gained control and upgraded the validator contract to a malicious version, bypassing all signature and validation checks. After the validator layer was compromised, the attacker took control of MintPool (token minting) and TokenSafe (reserve assets), minting 410 million CIOTX tokens and withdrawing approximately $4.4 million worth of various tokens from the bridge reserve. Currently, over 86% of all minted tokens have been locked or are in the process of being frozen. Another 12.8% (52.4 million IOTX) has been traced to Binance and is actively being frozen in cooperation with Binance and trading partners. Additionally, 0.4% (1.7 million) was traded on DEX. The attacker converted the stolen reserve tokens into approximately 2,183 ETH, of which about 1,572 ETH was converted into Bitcoin via THORChain, and all the Bitcoin has been spent.

IoTeX states that the ioTube bridge will be suspended across all chains until a comprehensive, independent security audit is completed. Furthermore, a community AMA will be held within 24-48 hours, and a detailed compensation plan will be announced within 48 hours.