{
 "slug": "iotex-iotube-bridge-key-compromise-feb-2026",
 "title": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
 "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026",
 "json": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "key-leak",
 "product": "IoTeX ioTube bridge (Ethereum side)",
 "tags": [
  "ethereum",
  "key-leak",
  "iotex",
  "iotube",
  "bridge",
  "social-engineering",
  "validator-key",
  "malicious-upgrade"
 ],
 "amountUsd": 4400000,
 "victims": null,
 "startedAt": "2026-02-21",
 "closedAt": "2026-02-24",
 "updatedAt": "2026-03-28T12:00:00Z",
 "summary": "On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users.",
 "timeline": [
  {
   "date": "2026-02-21",
   "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/"
  },
  {
   "date": "2026-02-21",
   "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/"
  },
  {
   "date": "2026-02-24",
   "title": "The IoTeX chain came back online at 06:06 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/"
  },
  {
   "date": "2026-03-02",
   "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/"
  },
  {
   "date": "2026-03-28",
   "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "How IoTeX Responded to the ioTube Bridge Incident: A Full Month in Review",
   "url": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "publisher": "IoTeX",
   "date": "2026-03-28"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you held assets bridged through ioTube, or CIOTX, on 21 February 2026, check the ioTube Claims Portal.\n\n## What to do now\n- Use only the claims portal linked from IoTeX's official site; ignore 'compensation' DMs and lookalike sites.\n- Don't buy or trade the deprecated CIOTX minted during the attack.\n\n## How to avoid this\n- Bridges concentrate risk: keep only what you need bridged and prefer bridges whose upgrades need a multisig and a timelock.\n- For teams: keep signing keys in hardware security modules or hardware wallets, never on staff laptops, and train staff against social engineering.",
 "notes": null,
 "agentBrief": "# IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine\n\n- Severity: Critical · Status: Partly contained (past)\n- Chains: Ethereum · Method: Leaked private keys and seed phrases\n- Started: Feb 21, 2026 · Last update: Mar 28, 2026 · Reported stolen: $4.4M\n- Who/what: IoTeX ioTube bridge (Ethereum side)\n\nOn 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users.\n\n## Am I affected?\nIf you held assets bridged through ioTube, or CIOTX, on 21 February 2026, check the ioTube Claims Portal.\n\n## What to do now\n- Use only the claims portal linked from IoTeX's official site; ignore 'compensation' DMs and lookalike sites.\n- Don't buy or trade the deprecated CIOTX minted during the attack.\n\n## How to avoid this\n- Bridges concentrate risk: keep only what you need bridged and prefer bridges whose upgrades need a multisig and a timelock.\n- For teams: keep signing keys in hardware security modules or hardware wallets, never on staff laptops, and train staff against social engineering.\n\n## Sources\n- How IoTeX Responded to the ioTube Bridge Incident: A Full Month in Review (IoTeX, 2026-03-28): https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/\n\nFull record: https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026 · JSON: https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}