Incident Overview
On February 21, 2026, IoTeX's ioTube multi-chain bridge suffered a ~$4.4M exploit on the Ethereum side when attackers compromised the Validator contract owner account, upgraded it to bypass all security checks, and drained bridge reserves while minting 410M CIOTX tokens.
The attack executed through a four-step chain beginning with compromise of the Validator contract's owner account on Ethereum. With administrative access, the attacker upgraded the Validator contract to a malicious implementation that bypassed all signature and validation checks, subverting the bridge's security layer. This allowed complete control over the MintPool (token minting) and TokenSafe (reserve assets) contracts.
The attacker minted 410 million CIOTX tokens and drained approximately $4.4M in various tokens including USDC, USDT, WBTC, and WETH from bridge reserves. IoTeX's rapid response successfully locked 315M CIOTX on Ethereum and Base with no liquidity paths. Of the 95M IOTX bridged to IoTeX chain, 40.5M remains in 29 identified attacker wallets being blacklisted via chain-level patch, 52.4M was deposited to Binance (with 41.6M routed through trading partners like Easybit and ChangeNow for freezing), and only 1.7M swapped on DEXs is considered lost.
The stolen reserve tokens were converted to approximately 2,183 ETH, with 1,572 ETH bridged to Bitcoin via THORChain, resulting in 66.78 BTC currently unspent across four monitored addresses.
Attacker Address: 0x6487B500…eD442f
Incident Report
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to IoTeX, these are the critical security checks that could have prevented this incident (February 2026).
- Verify all logic paths related to Private Key Compromised / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next IoTeX
The IoTeX hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.