What happened
On September 16, 2022, an address replayed an OmniBridge cross-chain message from Ethereum on the newly created EthereumPoW fork. The Ethereum-side transaction legitimately bridged 200 WETH. The same bridge-call calldata was then submitted on EthereumPoW, causing the copied bridge deployment to release an additional 200 ETHW.
The incremental ETHW extraction was reported at roughly $1,600 at the time. It did not drain Ronin or the canonical Ethereum to Gnosis bridge.
The EthereumPoW deployment retained a stale contract-stored chain ID after the fork. Its message-validation path did not bind the bridged message to the actual destination chain, allowing a valid Ethereum-side bridge message to be accepted on EthereumPoW.
Case & protocol details
Attack Timeline
The actor first used the Ethereum AMB route to bridge 200 WETH, creating calldata for safeExecuteSignaturesWithAutoGasLimit. A distinct EthereumPoW transaction reused that calldata. The copied bridge accepted the message because its destination-chain validation relied on an old chain ID stored by the contract instead of the live chain identity.
That released 200 ETHW from the fork-side contract. This was a cross-chain message or calldata replay, not a replay of the original Ethereum transaction itself.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.