402bridge Hack
What happened
On October 27, 2025, 402bridge’s Base contract was taken over after its ownership was transferred to 0x2b8F…361F. The new owner used the contract’s privileged transferUserToken function to pull USDC from wallets that had previously approved the contract, affecting more than 200 users. Security reports placed the total at 17,693 USDC.
The project said a private-key leak had compromised team wallets and was investigating the precise cause.
The incident combined a compromised privileged key with an owner-controlled function that could transfer tokens from any wallet that had granted approval. The team’s stated server-side key handling created a critical custody risk, and broad user approvals magnified the blast radius once ownership changed.
Case & protocol details
How it happened
Users had granted the 402bridge contract USDC approval for minting-related operations. Contract ownership was then transferred to 0x2b8F…361F. The new owner called transferUserToken, using the contract’s existing allowance to transfer remaining USDC from approved wallets.
Security reporting tracked the address consolidating and swapping proceeds; public evidence does not resolve whether the original key compromise was external or internal.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report GoPlus incident report chaincatcher.com
- transaction Base ownership transfer transaction basescan.org
- analysis Website reference x.com
- analysis Website reference x.com
- analysis 402bridge official incident statement x.com
- analysis Revoke.cash 402bridge incident page revoke.cash
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
