Multichain Hack
What happened
On 6 July 2023, about $126 million left the MPC addresses that held locked assets for Multichain's bridges, without any announcement from the team. The Fantom bridge lost the most, roughly $120 million in wBTC, WETH, USDC, DAI, LINK and other tokens. The Moonriver bridge lost about $6.8 million and the Dogechain bridge about $666,000.
Multichain said the locked assets had been "moved to an unknown address abnormally" and told users to stop using the service and revoke approvals. Circle and Tether froze about $65 million of the stablecoins involved. On 14 July Multichain said Chinese police had detained CEO Zhaojun on 21 May and seized his devices and mnemonic phrases.
According to its statement, the MPC node servers ran under his personal cloud server account, so no one else could access them once he was detained, and login activity from a Kunming IP address was found on the cloud server platform alongside transfers from the MPC addresses. Zhaojun's sister moved remaining funds to addresses she controlled on 9 July and was detained on 13 July, after which Multichain ceased operations. It is still not established whether the outflows were an external hack, an insider action or a seizure.
Chainalysis described both a hack and a rug pull as possible.
Protocol details
Security review history
- SlowMist View report
- PeckShield View report
- Trail of Bits View report
Post-Incident Timeline
-
2023-07-10
On July 10, 2023, the Multichain project, experienced another significant exploit incident. Indicating that unauthorized access to the system was gained, leading to a substantial loss of funds across various chains. The funds were transferred to the single EOA in nine chains. The transfer behavior suggested that the attacker had control over all the assets and was not in a hurry to move them, leading to speculation that the incident could have resulted from an internal operation. Here is the breakdown of the funds lost by chain: - Arbitrum: $14,371,766 USD worth of USDC, WETH, and WBTC - Fantom: $48,560,731 USD worth of USDC, WETH, DAI, WBTC, and over 60,000,000 non-liquid fUSDT tokens - Optimism: $11,080,749 USD worth of USDC, DAI, and WBTC - Cronos: $10,911,004 USD worth of USDC, WETH, and DAI - Polygon: $10,990,882 USD worth of USDC, WETH, and WBTC - Avalanche: $3,190,649 USD worth of DAI and WBTC - Binance Smart Chain: $1,770,304 USD worth of USDC and BTCB - Moonbeam: $237,657 in USDC - Ethereum: $15,291 USD worth of DAI The total amount stolen in liquid assets is approximately $101,129,033 USD.
Evidence
- report @tayvano_ incident report twitter.com
- report @multichainorg incident report twitter.com
- report @BeosinAlert incident report twitter.com
- transaction etherscan.io transaction 0xbd29…7fc4 etherscan.io
- transaction etherscan.io transaction 0xda80…e62e etherscan.io
- address etherscan.io address 0x027f…5cd8 etherscan.io
- address etherscan.io address 0x418e…5bb7 etherscan.io
- analysis Multichain Bridges Experience Unannounced Outflows of Over $130M in Crypto coindesk.com
- analysis DeFiLlama defillama.com
- analysis Multichain Exploit: Possible hack or rug pull chainalysis.com
- analysis Recently Exploited Crypto Bridge Shuts, Says China Detained CEO and His Sister coindesk.com
- analysis Multichain Confirms CEO Arrest, Ceases Operations Indefinitely bitcoinist.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
