## Executive Summary

On February 21, 2026, the IoTeX team identified and transitioned to emergency response following a security breach affecting **ioTube,** the IoTeX multi-chain bridge. The exploit was isolated specifically to the Ethereum-side. We are providing this comprehensive report to outline what happened, the status of funds, and our path forward for recovery and compensation. Our forensic analysis indicates this was a sophisticated, professional operation with possible connections to prior high-profile DeFi exploits. Full attribution details will be included in the post-mortem report.

### **What is Safe**

First and foremost, we want to clarify the scope of this incident to reassure our community:

- **IoTeX L1 Chain is Safe:** The IoTeX Layer 1 chain, its consensus mechanism, and all native smart contracts were **NOT** compromised.
- **User Assets on IoTeX & Exchanges are Safe:** Your IOTX tokens on the IoTeX chain and within centralized exchanges are unaffected.
- **Isolated Exploit:** The breach was isolated strictly to ioTube's **Ethereum-side** bridge contracts. Bridge contracts on other chains like BSC and Base were not affected.

### **The Incident: Root Cause & Technical Breakdown**

The attack targeted the Ethereum-side of the ioTube bridge through a sophisticated four-step chain:

1. **Validator Key Compromise:** The owner account of the Validator contract on Ethereum was compromised, granting the attacker administrative control.
2. **Malicious Upgrade:** The attacker used this access to upgrade the Validator contract to a malicious version that bypassed all signature and validation checks.
3. **Contract Takeover:** With the validator layer subverted, the attacker took control of the MintPool (token minting) and TokenSafe (reserve assets).
4. **Asset Drainage:** The attacker minted 410M CIOTX and drained approximately $4.4M in various tokens from the bridge reserves.

### **Current Asset Status & Recovery Efforts**

We detected the incident within hours and took immediate action to contain the damage. Our on-chain tracing confirms that the vast majority of stolen assets are already secured:

#### **Part A: 410M CIOTX (MintPool)**

The attacker minted 410M CIOTX. Through our rapid response protocol, over 86% of all minted tokens are already locked or being frozen — assets we can secure directly through our own chain-level controls. An additional 12.8% (52.4M IOTX) has been traced to Binance, where we are actively working with Binance and trading partners to freeze. Only 0.4% (1.7M) was swapped on DEX and is considered at risk.

- **Ethereum & Base (315M CIOTX):** These are completely locked with no liquidity or bridge path.
- **IoTeX Chain (95M IOTX):**Actively Recovering. Full on-chain tracing is complete. Of the 95M:
  - **40.5M remains in attacker wallets** — We have identified 29 attacker-controlled addresses on the IoTeX chain and are blacklisting all of them via a chain-level patch. At this moment, we are distributing a patch to chain delegates.
  - **52.4M was deposited to Binance** — of which 41.6M was routed through trading partners (Easybit, ChangeNow, etc.). We are actively working with Binance and these trading partners to freeze all deposited funds.

**1.7M was swapped on DEX** — already converted to other tokens. This is the only portion considered at risk, representing just 0.4% of total minted CIOTX.

#### **Part B: Bridge Reserves (TokenSafe)**

The attacker converted stolen reserve tokens (including USDC, USDT, WBTC, WETH and other assets) into approximately **2,183 ETH**. Of this, approximately 1,572 ETH was bridged to Bitcoin via THORChain, with the remainder dispersed across intermediate Ethereum addresses under active monitoring.

- **Status:**We have identified 4 Bitcoin addresses holding a total of 66.78 BTC.
  - 12V7jhcPnqnGbRFMasSW2CZVBd8qpvUgAK
  - 16xusPKLMyqK68SkhfXDtic6AJPDi51tqh
  - 1PN2BoHU4buDQWcrNHk9T9NBA2qX8oyYEc
  - 135oSa2fobTxtHtm5dwTREDyRY2o1DG1Aw
- **Monitoring:** As of this report, **all BTC remains unspent**. These addresses are flagged and under continuous 24/7 monitoring by our team and analytics partners.

### **Immediate Actions & Resumption Timeline**

Our team is working around the clock to restore full services:

- **IoTeX L1 Chain:** We are starting to distribute patch to chain delegates now; once we have enough patched delegates online, consensus and normal operations will be resumed automatically.
- **Exchange Activity:** We anticipate withdrawals will resume within **24–48 hours**, with deposit functionality following shortly thereafter.
- **Community AMA**: We will host a community AMA for more details within **24–48 hours.**
- **Compensation plan:** A detailed compensation plan for affected bridge users will be published within **48 hours**.
- **ioTube Bridge:** Bridge operations will remain suspended across **all chains** until a full, independent security audit is completed. We will also expedite the implementation and roll out of [IIP-55](https://hub.iotex.io/governance/iip-55-dynamic-witness-committee-for-iotube?ref=iotex.io).
- **Legal & Forensics:** We have engaged law enforcement and top-tier on-chain analytics firms. Attacker addresses have been flagged on Etherscan as 0x6487B5006904f3Db3C4a3654409AE92b87eD442f (lablled as _Fake\_Phishing2054654 on etherscan)_.
- **White-hat Bounty:** On-chain message will be sent to attacker offering a white-hat bounty for voluntary return of funds.

### **Our Commitment to Users**

The security of our community’s assets is our highest priority. We are fully committed to making affected users whole:

- **Compensation:** A detailed compensation plan for affected bridge users will be published within **48 hours**.
- **Interim Support:** Bridge-back requests will be processed manually on a case-by-case basis during this period.
- **Transparency:** We will host a community AMA with our founding team within the next **24-48 hours**.

### **The Path Forward: Hardening Our Security**

This incident is a turning point that has driven us to implement one of the most resilient, multi-layered security frameworks for our cross-chain infrastructure:

- **Rigorous Re-Audits:** ioTube will remain paused until a full, independent security audit is completed and all vulnerabilities are remediated.
- **Decentralized Governance:** We are introducing Multi-signature and 24-hour Time-lock controls to eliminate single points of failure. We will also expedite the implementation and roll out of [IIP-55](https://hub.iotex.io/governance/iip-55-dynamic-witness-committee-for-iotube?ref=iotex.io), a governance proposal to decentralize bridge validation through a multi-party validator set.
- **Intelligent Safeguards:** New per-transaction and daily volume limits are being integrated to proactively contain risks.
- **Security Bug Bounty:** We are launching an expanded Bug Bounty program to collaborate with the global white-hat community in securing our ecosystem.

We thank the IoTeX community for your patience and continued support as we navigate this recovery together.

**The IoTeX Team**