What happened
On April 9-10, 2026, attackers compromised Aethir ATH bridge adapters on alternate chains. Aethir said the canonical ATH supply on Ethereum and the ETH-ARB Squid bridge were unaffected, disconnected the compromised adapters, and committed to compensate affected users.
The bridge adapter contracts permitted an unauthorized actor to mint or release bridged ATH, creating an access-control failure at the bridge boundary even though the canonical Ethereum ATH supply was not changed.
How it happened
The attacker used unauthorized access to bridge adapter contracts to fraudulently mint ATH on Solana and Base, which unlocked ATH backed by assets held in the bridge adapter on Ethereum. Aethir and counterparties disconnected the affected contracts and removed liquidity to contain the incident.
Protocol details
Market Context at Time of Hack
Evidence
- report @peckshield incident report x.com
- report @AethirCloud incident report x.com
- report @BPmetax incident report x.com
- analysis DeFiLlama defillama.com
- analysis Aethir: ATH Security official statement t.me
- analysis DefiLlama: Aethir security incident defillama.com
- analysis Smart Contract Hacking: Aethir Hack smartcontractshacking.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
