Anyswap Hack
What happened
On July 10, 2021, an attacker exploited Anyswap’s prototype V3 cross-chain liquidity pools after two BSC MPC-router signatures reused the same ECDSA R value. The duplicate nonce made it possible to derive the MPC account’s private key, then issue unauthorized router actions that drained USDC and MIM on Ethereum, BSC, and Fantom. Anyswap said its default bridge and V1/V2 were unaffected.
The V3 router’s MPC signing process produced two ECDSA signatures with the same R value, indicating nonce reuse. That cryptographic failure allowed recovery of the MPC private key and turned bridge-signing authority into an unauthorized withdrawal capability. This was not a signature-replay incident.
Case & protocol details
How it happened
Anyswap detected two V3 Router MPC signatures on BSC with the same R value. Reusing an ECDSA nonce can reveal the signing private key, and the team said it reproduced that result. With the derived MPC authority, the attacker initiated unauthorized V3 router actions across the affected pools.
The official disclosure identifies four drains: USDC on Ethereum, BSC, and Fantom, plus MIM on Ethereum. The team fixed signature generation to prevent duplicate R values, audited V1/V2 transactions, and planned a V3 relaunch after the timelock.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
