IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine
IoTeX ioTube bridge (Ethereum side)
On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users.
Why this severity: $4.4M reported stolen, only partly contained.
- Started
- Feb 21, 2026
- Closed
- Feb 24, 2026
- Chains
- Ethereum
- Reported stolen
- $4.4M
At risk
- IoTeX ioTube bridge (Ethereum side)
- Ethereum wallets
What to do now
- Use only the claims portal linked from IoTeX's official site; ignore 'compensation' DMs and lookalike sites.
- Don't buy or trade the deprecated CIOTX minted during the attack.
Stay safe
Am I affected?
If you held assets bridged through ioTube, or CIOTX, on 21 February 2026, check the ioTube Claims Portal.
What to do now
- Use only the claims portal linked from IoTeX's official site; ignore 'compensation' DMs and lookalike sites.
- Don't buy or trade the deprecated CIOTX minted during the attack.
How to avoid this
- Bridges concentrate risk: keep only what you need bridged and prefer bridges whose upgrades need a multisig and a timelock.
- For teams: keep signing keys in hardware security modules or hardware wallets, never on staff laptops, and train staff against social engineering.
Timeline 5
IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.
SourceIoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.
SourceThe IoTeX chain came back online at 06:06 UTC.
SourceIoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.
SourceAt 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.
Source
Alerts & on-chain evidence 1
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.