What happened
On October 27, 2025, 402bridge’s Base contract was taken over after its ownership was transferred to 0x2b8F…361F. The new owner used the contract’s privileged transferUserToken function to pull USDC from wallets that had previously approved the contract, affecting more than 200 users. Security reports placed the total at 17,693 USDC.
The project said a private-key leak had compromised team wallets and was investigating the precise cause.
The incident combined a compromised privileged key with an owner-controlled function that could transfer tokens from any wallet that had granted approval. The team’s stated server-side key handling created a critical custody risk, and broad user approvals magnified the blast radius once ownership changed.
How it happened
- Users had granted the 402bridge contract USDC approval for minting-related operations.
- Contract ownership was then transferred to 0x2b8F…361F.
- The new owner called transferUserToken, using the contract’s existing allowance to transfer remaining USDC from approved wallets.
- Security reporting tracked the address consolidating and swapping proceeds; public evidence does not resolve whether the original key compromise was external or internal.
Protocol details
Evidence
- report @PeckShieldAlert incident report x.com
- report @402bridge incident report x.com
- report @GoPlusSecurity incident report x.com
- report 402bridge official incident statement x.com
- report GoPlus incident report chaincatcher.com
- transaction Base ownership transfer transaction basescan.org
- analysis DeFiLlama defillama.com
- analysis Revoke.cash 402bridge incident page revoke.cash
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
