Cross-Chain Bridge Exploits

A bug in how NEAR Intents' Omni deposit and withdrawal system interacted with its smart contract let an attacker trigger irregular withdrawals from the protocol's BNB Chain hot wallet. CoinDesk reported that the contract-side vulnerability had since been patched, without giving a time, and deposits and withdrawals were disrupted on 11 networks while it investigated.

Outcome: The funds were moved to KuCoin and converted to bitcoin. NEAR Intents said it identified the attacker and set a 48 hour deadline, and about a day later the exploiter returned the funds in full. NEAR Intents closed its investigation and had pledged full reimbursement to users.

NEAR, BNB Chain The Block CoinDesk Decrypt on the return

Payy's post-mortem, posted on 29 September 2026 and supported by a Spearbit review, says an attacker submitted an invalid burn proof that Payy's deployed Noir/Barretenberg verifier accepted. The flaw sat in Barretenberg's small-subgroup IPA verification path, which lacked a boundary check that Aztec added in a fix committed on 14 May 2026 and released in v5.0.0 on 13 July. Aztec did not notify Payy, which was running a pinned October 2025 build, and the rollup contract had no independent check that a burn hash be nonzero. The forged burn, with zero note commitments and a zero burn hash, was recorded on Payy's network at 03:25:41 UTC on 24 September. Ethereum settlements at 04:21:23 and 09:30:35 UTC paid out 1,828,589.378 USDC and 90,202.820 USDC, and a second burn of 1 USDC was fronted by a burn substitutor whom the rollup later reimbursed, for 1,918,793.198 USDC in total. The stolen funds were users' non-custodial deposits.

Outcome: Payy paused all network transactions on 24 September and on 25 September (UTC) ruled out a compromised key, social engineering and an off-chain infrastructure exploit. Its post-mortem traced 682.3 ETH from the first payout into Tornado Cash on 26 September, while the 90,202.82 USDC from the second settlement was still in the receiving wallet on 28 September. No recovery has been announced. Payy opened a claims process paying eligible users in USDC on Ethereum, with the wallet to close when it ends, then paused the form on 13 October to rework it and said the 30-day window would reset.

Ethereum, Payy Network Payy post-mortem Payy on X Payy remediation form Certora analysis Unchained KuCoin

Meter attributed the incident to a block validation flaw (as reported by CoinGabbar), which let an attacker mint wrapped MTRG on BNB Chain without depositing the underlying MTRG. Blockaid flagged roughly $2.3MM of unbacked tokens minted across two transactions, partly sold on PancakeSwap before Meter intervened. No detailed post-mortem has been located.

Outcome: Meter paused its mainnet and bridge and said transactions after block 100731417 may not be honored. MTR and MTRG each fell by roughly 75% to 80%.

BNB Chain, Meter CoinGabbar (Meter update) CryptoTimes Crypto-Economy

Blockstream's Elements software cached range proof verifications under a key that did not fully capture the transaction context, so an attacker could point new, invalid issuance data at a previously approved cache entry and skip verification. This let the attacker mint roughly 4,000 L-BTC with no bitcoin backing them and withdraw them from the federation's reserve wallet.

Outcome: The attacker, who described themselves as a white hat, returned about 3,400 BTC and kept about 598.5 BTC, demanding a 10% bounty that Blockstream refused to treat as white-hat activity. Liquid halted transactions, and block production resumed on 10 September while peg-outs stayed suspended.

Bitcoin, Liquid Network CoinDesk Chainalysis The Block on the bounty dispute Cointelegraph on the restart

A second drain of the same bridge contract from a new wallet. Per Rekt, citing SlowMist, VerusProof.checkExportAndTransfers checked the transfer hash against attacker-supplied transfer data but never validated the export's accounting values (total amounts, fees, burned amounts and output value) or that the prior export held enough value to cover the payouts. The attacker made a legitimate 0.01 VRSC transfer, then submitted a forged export committing to eight payouts, and the genuine notarized heights let the proofs pass. The checkCCEValues fix made after May held, so this was a different code-level gap in the same trust boundary rather than the May bug repeated, although Blockaid described the same entry path and bug class. Some reports date it 22 July, and this entry uses 23 July, as most sources do.

Outcome: Not reported recovered. Rekt reports no statement or bounty offer from Verus, and the funds, consolidated into about 3,916 ETH, were moved through Tornado Cash.

Ethereum, Verus The Block Rekt Whale Alert

Five hot-validator keys signed one withdrawal worth about 24.15MM USDC, reaching the voting threshold of the bridge's off-chain validator set, and the withdrawal passed a 200 second dispute window. No smart contract bug was involved, and QuillAudits concluded the off-chain signing system was compromised. Arbitrum's own bridge was not breached.

Outcome: AFX offered the attacker a white-hat settlement, keeping 30% in return for sending back the other 70%. The USDC was swapped for about 12,467 ETH. SEAL and zeroShadow said a link to the Lazarus-affiliated group UNC4899 was preliminary.

Arbitrum, Ethereum Rekt Halborn technical analysis Unchained

About $4.3MM in USDC, 274 WETH and smaller balances were withdrawn from the bridge. The Block reported a suspected compromised signing key, while Rekt traced it to a permissionless token-deployment function that let the attacker poison the token registry. Neither Gravity nor Althea had confirmed a cause at the time of the reports. Reports date the drain to 29 or 30 May, and this entry uses 30 May.

Outcome: Network halted. Part of the proceeds were laundered through ChangeNow and Binance, and Rekt reports flows into Tornado Cash.

Ethereum, Cosmos The Block Rekt BeInCrypto Analysis

The bridge verified notary signatures and Merkle proofs correctly but never checked that the source amount recorded on Verus matched the payout claimed on Ethereum, so a valid proof could be used to draw out more than was deposited (Merkle Science). The attacker took 103.6 tBTC, 1,625 ETH and 147,000 USDC.

Outcome: The attacker returned 4,052.4 ETH and kept 1,350 ETH, about 25%, under a bounty arrangement Verus offered publicly.

Ethereum, Verus Halborn technical analysis Merkle Science analysis The Block on the return Analysis

THORChain's own report traces the loss of roughly $10MM (third-party trackers put it at $10.7MM or more) to the GG20 threshold-signature library it inherited from Binance. A malicious validator combined three weaknesses, a key-generation check that accepted a malformed Paillier modulus, a range proof that did not bind its commitment, and a blinding value too small to hide its secret, to reconstruct a vault's private key from leaked key shares. The protocol's signing proofs failed to reject inputs they should have, so it is classed as a verification flaw rather than a conventional key theft.

Outcome: The affected vault was paused and every validator upgraded to v3.19.1 before signing resumed. THORChain plans to move away from GG20. RUNE fell 12%.

Bitcoin, Ethereum, BNB Chain, Base THORChain Exploit Report #2 CoinDesk The Block Analysis

A forged cross-chain message was accepted after the LayerZero Labs verifier (DVN) that Kelp's rsETH bridge relied on attested to it. LayerZero's incident report says the breach began on 6 March 2026, when two internal RPC nodes the DVN read from were compromised, and that an external RPC provider was then knocked offline so the DVN relied only on the compromised nodes. Mandiant, CrowdStrike and independent researchers cited in the report attribute the attack to the North Korean group TraderTraitor. The bridge required a single verifier, so no second check existed, and 116,500 rsETH (about $292MM) was released from the reserve behind wrapped versions on more than 20 chains on 18 April 2026. Kelp's emergency pause came 46 minutes after the drain and blocked two further attempts of roughly 40,000 rsETH each. Kelp and LayerZero dispute who chose the 1-of-1 verifier setup.

Outcome: LayerZero Labs said its DVN would no longer sign as the sole required verifier on any channel and that it rebuilt the compromised infrastructure. Kelp announced on 5 May that rsETH bridging would move to Chainlink CCIP. Chainlink's blog of 20 May said seven teams had announced migrations to Chainlink in the previous two weeks, representing more than $4Bn in total value, a tally that included a move of more than $400MM to Chainlink Data Feeds rather than CCIP and put Kelp's rsETH at more than $1.5Bn. In an 18 August update Chainlink raised its figure to $15Bn migrating to CCIP. These are Chainlink's tallies of announced migrations, not measured flows.

Ethereum LayerZero Labs incident report CoinDesk CoinDesk on the configuration dispute The Block on the move to CCIP Chainlink blog, 20 May 2026 (archived original) Chainlink blog (updated 18 August 2026) Analysis

An attacker drained about $11.4MM of the solver's own assets across multiple chains from one of Garden's independent solvers, the market makers whose inventory fills cross-chain swaps on the network. Garden's incident report, dated 28 January 2026 and released through Chainwire the next day, says the attacker obtained the solver's SSH key from the local device used to run its production executor, gained root access to the solver server and found the solver's private key stored in an environment variable. EY's review of the server's SSH logs found access from four IP addresses in Japan and China on 30 October 2025, and zeroShadow said the incident originated from a leaked private key on a compromised device, although the exact method of compromise is unknown, and linked it with high confidence to the North Korea-affiliated group DangerousPassword. Garden says no protocol contracts were compromised and no user funds were at risk. The report names Solana and BNB Chain among the drained balances without itemizing the rest. The loss is counted because the solver inventory is the liquidity that settles transfers across Garden's network, which this page treats as cross-chain infrastructure, but it was not a loss of user deposits held in custody. ZachXBT questioned whether the solver was independent of Garden.

Outcome: Garden paused all user-facing services and posted an on-chain offer of a 10% bounty on the solver's behalf, which drew no response. Funds were bridged off Solana via Mayan, swapped to ETH and deposited into Tornado Cash. Garden said it removed the need for solvers to be reachable on public IP addresses, added independent third-party solvers and appointed a new CISO. In late July 2026 an attacker who reached an independent solver's off-chain database drained about $450K in USDT across Ethereum, Base, Arbitrum and BNB Chain (per Blockaid), and Garden again paused its services, telling Cointelegraph that only solver-owned assets were affected.

Solana, BNB Chain, Other EVM chains (not itemized) Garden incident report (archived copy, removed from garden.finance) Garden forensic findings (Decrypt, Chainwire release) The Block (Garden release) Cointelegraph on the July 2026 incident Web3 is Going Just Great The Register

A contract upgrade left a flaw in how the bridge counted operator votes, which a whitehat operator exploited, reportedly via an MEV bot, before any malicious actor did.

Outcome: Returned by the whitehat operators within days. Ronin planned a $500K bounty.

Ethereum, Ronin CoinDesk Halborn analysis Decrypt

A newly deployed facet on the LI.FI cross-chain aggregator allowed arbitrary calls, which the attacker used to drain 153 wallets holding infinite approvals to the LI.FI contract. LI.FI is a router rather than a custody bridge, which is why it is tagged cross-chain infrastructure.

Outcome: LI.FI disabled the facet on all chains and said it was evaluating options to fully compensate affected users. No recovery was reported.

Ethereum, Arbitrum LI.FI incident report CoinDesk

A route contract on the Socket cross-chain aggregator failed to validate user-supplied calldata, letting the attacker drain wallets that had granted the gateway unlimited token approvals. Only users with live approvals were affected. Socket is a router rather than a custody bridge, which is why it is tagged cross-chain infrastructure.

Outcome: Socket said it recovered about $2.3MM (1,032 ETH) of the $3.3MM and promised a distribution plan. Users were urged to revoke approvals.

Ethereum The Block The Block on the recovery DL News

About $81.5MM was drained from the bridge's Ethereum vault on New Year's Eve UTC. Rekt and Halborn believe signer keys on the vault multisig were compromised, but no post-mortem has been published. In January 2024 operator Ozys alleged that a former CISO had weakened a firewall, a company claim that remains unproven.

Outcome: Not recovered.

Ethereum, Orbit Chain Rekt Halborn technical analysis CoinDesk ForkLog on the Ozys statement

A compromised operator key authorized withdrawals from the bridge, about $87MM per CertiK (PeckShield counted $86.6MM). HTX exchange hot wallets were also drained in the same window, about $23.4MM per Wintermute's head of research (ForkLog), while CertiK counted $13.6MM taken from HTX hot wallets on Ethereum plus $12.6MM of suspicious TRON transfers. That is a separate exchange theft, excluded from this figure and from the totals on this page.

Outcome: Not recovered. Justin Sun pledged that HTX would fully compensate its hot wallet losses (ForkLog). No compensation for the bridge losses was confirmed in the sources cited here.

Ethereum, HECO CertiK The Block Neptune Mutual analysis ForkLog on the loss estimates

Funds moved out of multiple bridge contracts, more than $102MM of it from the Fantom bridge contract on Ethereum (Unchained). Multichain said its CEO had been taken away by Chinese police in May 2023 and that the team had lost access to its MPC servers. CertiK attributed the outflows to a private key compromise, while Chainalysis described them as a possible hack or insider rug pull, and Decrypt later reported that the CEO's sister had moved assets out of the MPC wallets. Every reading involves the keys, but whether they were stolen or used by insiders has never been settled and Multichain published no post-mortem, so the cause is classed as undisclosed under this page's rule for contested causes.

Outcome: The protocol ceased operations. Circle and Tether reportedly froze more than $65MM of related stablecoins. The rest was not recovered.

Ethereum, Fantom, Moonriver, Dogechain Decrypt Cointelegraph on the Chainalysis assessment CertiK on the private key reading Unchained on the outflows Bridge hack list (cwhinfrey)

The attacker minted 57 tokens across 10 chains but cashed out only about 5,196 ETH ($10.1MM) because liquidity was thin. Beosin and Dedaub suggested compromised admin keys, alleging that keys for three of four admin wallets were taken, but Poly Network had not confirmed a cause. Reports date the attack to 1 or 2 July, and this entry uses 2 July.

Outcome: Poly Network suspended services and appealed to the attacker to return the funds. No recovery was reported.

Ethereum, BNB Chain, Polygon, Metis The Block

A flaw in IAVL merkle proof verification let the attacker forge a proof for a withdrawal that was never deposited, minting 2MM BNB. The $566MM is the nominal value of the BNB minted, not the amount that left the chain.

Outcome: Validators halted the chain. About $100MM of the minted BNB left the chain (estimates run to $110MM or more) and most of the rest never moved. Roughly $7MM was reportedly frozen.

BNB Beacon Chain, BNB Chain BNB Chain (official) BNB Chain (official follow-up) Halborn technical analysis The Block

A routine initialization set a trusted root to zero, which made every message appear pre-approved. Once the first transaction was public, hundreds of accounts copied it in an open free-for-all.

Outcome: Whitehats returned about $36MM, roughly a fifth, within weeks (per Zerion). The rest was not recovered.

Ethereum, Moonbeam, Evmos Halborn technical analysis Elliptic Zerion on the returned funds The Block

The bridge ran a 2-of-5 multisig, so compromising two signers was enough to authorize any transfer. The quorum was the vulnerability.

Outcome: Not recovered. The FBI attributed the theft to the Lazarus Group in January 2023.

Ethereum, Harmony Harmony (official) Halborn technical analysis The Block on the multisig takeover The Block on the FBI attribution

The attacker obtained 5 of 9 validator keys, 4 belonging to Sky Mavis and a 5th to Axie DAO, the latter reachable through an allowlist left in place after an earlier scaling arrangement. Every signature was valid.

Outcome: Attributed to the Lazarus Group by US authorities in April 2022. Largely not recovered. Sky Mavis raised $150MM in Binance-led funding to reimburse users.

Ethereum, Ronin Halborn technical analysis US Treasury (OFAC attribution) Decrypt on the $150MM raise

The Solana-side contract could be tricked into accepting a forged guardian signature set, letting the attacker mint 120,000 wETH without depositing anything.

Outcome: Jump Crypto replaced the shortfall within days. In February 2023 the exploiter's remaining vault positions at Oasis.app were recovered under an English High Court order, reportedly in coordination with Jump.

Ethereum, Solana Kudelski Security vulnerability analysis Halborn technical analysis CertiK incident analysis Citation Needed on the Oasis recovery

A deposit function accepted a zero-value transfer as though collateral had arrived, letting the attacker mint borrowing power against nothing. 206,809 BNB was drained.

Outcome: Not recovered.

Ethereum, BNB Chain Merkle Science analysis Qubit Finance post-mortem

An attacker exploited a bug in the codebase of the pNetwork pBTC-on-BNB Chain bridge and drained 277 BTC of collateral. No technical post-mortem that this database could locate states the specific flaw.

Outcome: pNetwork offered a $1.5MM bounty for the return of the funds. No recovery has been reported.

Bitcoin, BNB Chain The Block

A crafted cross-chain message called a function whose 4-byte selector collided with the one that replaces the keeper set, and the manager contract did not restrict which contract and method a relayed message could reach. That put a privileged function in the hands of an unauthorized caller, who swapped in their own keeper address and authorized withdrawals as the protocol. It is classed as an access control flaw because the failure was that reachability, not a stolen key (BlockSec and CertiK found no key theft), although the selector collision and missing target checks also make a contract logic reading defensible.

Outcome: Substantially all funds were returned in stages over about 13 days, the last batch on 23 August 2021. Tether froze about $33MM of USDT along the way.

Ethereum, BNB Chain, Polygon BlockSec analysis CertiK analysis CNBC (final return)

The attacker used a fake router and fake vault to forge a deposit event carrying a malicious memo, which the Bifrost refund logic honored, paying out ALCX, XRUNE, USDC, SUSHI, YFI and USDT. THORChain first estimated the loss at about $800K.

Outcome: RUNE fell about 25%. The attacker left most of the loot behind, and Rekt does not report a confirmed recovery.

Ethereum, THORChain Rekt

A bug in the Bifrost Ethereum router read the transaction value incorrectly in an override loop, letting the attacker withdraw about 2,500 ETH plus SUSHI, YFI, DODO and ALCX they had not deposited.

Outcome: Funds were not reported recovered.

Ethereum, THORChain Rekt

The V3 router's MPC signing reused an ECDSA nonce (the k value) in two transactions on BNB Chain, which let the attacker back-calculate the router's private key and move about 5.5MM MIM and 2.4MM USDC. Only the V3 pools were affected. The key was not stolen from an operator but leaked by a defect in the signing protocol itself, so it is classed as a signing-protocol flaw, the same rule applied to THORChain's GG20 incident in 2026. TechFlow dates the attack to 4:00 AM Beijing time on 11 July, which is 10 July UTC.

Outcome: Anyswap patched the code and reopened after a 48 hour timelock. TechFlow reported that the team said it would compensate the losses.

Ethereum, BNB Chain, Fantom Rekt The Defiant TechFlow on the compensation pledge