Incident Overview
On April 10, 2026, Aethir's bridge contracts connecting Ethereum to other chains were exploited for an initially estimated $400K, though rapid response contained actual losses to under $90K. The attacker bridged stolen funds from BNB Chain to Tron. Aethir disconnected compromised contracts, froze attacker wallets through exchanges, and plans full user compensation next week.
The attack targeted Aethir's AethirOFTAdapter bridge contracts that connect Ethereum to other chains. The exploiter drained funds and immediately began moving them from BNB Chain to Tron using symbiosis.finance as the bridging service. Aethir detected the exploit quickly and took immediate action.
The team disconnected all compromised bridge contracts to prevent further losses. They coordinated with centralized exchanges including Binance and Upbit to freeze the attacker's wallets. These swift containment measures limited the actual damage to under $90K despite initial estimates of over $400K in potential exposure. The main ATH token supply on Ethereum remained completely unaffected. The ETH-ARB bridge on Squid also continued operating normally.
Attacker Addresses (Tron):
TNC4wgK518RZdZVa6NPZLnqy6FEswA4G15
TL38ssgWktRRfhdjGEyfVkPD8CdP2UPq18
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Aethir, these are the critical security checks that could have prevented this incident (April 2026).
- Verify all logic paths related to Acces Control Exploit / Other are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
- 03
Learn to Prevent the Next Aethir
The Aethir hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.