What happened
On November 23, 2025, an attacker exploited Port3's BNB Chain cross-chain token contract to mint about one billion unauthorized PORT3. A zero-address edge case in signature verification allowed an invalid signature to pass after ownership had been renounced. The attacker sold 162.75 million PORT3 for about 199.5 BNB (about $166,000) and burned the remainder.
How it happened
- Contract ownership had been renounced, leaving its authority at
address(0). - The attacker supplied an invalid signature to
registerChains; failedecrecoverreturned the zero address, which matched the authority. - It registered a chain implementation and invoked
bridgeInto mint unauthorized PORT3 on BNB Chain. - It sold part of the mint for BNB and burned the remaining PORT3 after the project removed liquidity and exchanges suspended deposits.
Protocol details
Classification
Protocol Logic / Token & Share Accounting
Protocol Type
DeFi Protocol
Category
Bridge Hack
Implementation language
Solidity
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
