Incident Overview
Multichain, a crosschain bridge, was exploited leading to an estimated loss of 231,000,000 $USD.
Cross-chain Bridge Multichain faced an exploit resulting in nearly $130 million being siphoned out of various token bridges. The assets locked up in the Multichain MPC address were moved abnormally to an EOA address. The unexpected outflows led to Multichain’s Fantom Bridge losing its entire holdings in wBTC, USDC, USDT, and a handful of altcoins, worth over $130 million in total.
Similar outflows were observed from Multichain’s Moonriver and Dogecoin bridge contracts. The assets transferred out of the Multichain Fantom bridge include DAI, LINK, USDT, wBTC, wETH, and USDC. Multichain team announced the team is not sure what happened.
The most possible cause of the exploit is wallet compromise, but there is also the possibility of an insider hack.
Suspicious Addresses:
https://etherscan.io/address/0x418ed255…6e5bb7
https://etherscan.io/address/0x027f1571…b05cd8
Funds Moving Transactions:
https://etherscan.io/tx/0xda80a8c8…5fe62e
https://etherscan.io/tx/0xbd29fe07…477fc4
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Multichain, these are the critical security checks that could have prevented this incident (July 2023).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialPost-Incident Timeline
-
2023-07-10
On July 10, 2023, the Multichain project, experienced another significant exploit incident. Indicating that unauthorized access to the system was gained, leading to a substantial loss of funds across various chains. The funds were transferred to the single EOA in nine chains. The transfer behavior suggested that the attacker had control over all the assets and was not in a hurry to move them, leading to speculation that the incident could have resulted from an internal operation. Here is the breakdown of the funds lost by chain: - Arbitrum: $14,371,766 USD worth of USDC, WETH, and WBTC - Fantom: $48,560,731 USD worth of USDC, WETH, DAI, WBTC, and over 60,000,000 non-liquid fUSDT tokens - Optimism: $11,080,749 USD worth of USDC, DAI, and WBTC - Cronos: $10,911,004 USD worth of USDC, WETH, and DAI - Polygon: $10,990,882 USD worth of USDC, WETH, and WBTC - Avalanche: $3,190,649 USD worth of DAI and WBTC - Binance Smart Chain: $1,770,304 USD worth of USDC and BTCB - Moonbeam: $237,657 in USDC - Ethereum: $15,291 USD worth of DAI The total amount stolen in liquid assets is approximately $101,129,033 USD.
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Multichain
The Multichain hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.