# IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine

- Severity: Critical · Status: Partly contained (past)
- Chains: Ethereum · Method: Leaked private keys and seed phrases
- Started: Feb 21, 2026 · Last update: Mar 28, 2026 · Reported stolen: $4.4M
- Who/what: IoTeX ioTube bridge (Ethereum side)

On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users.

## Am I affected?
If you held assets bridged through ioTube, or CIOTX, on 21 February 2026, check the ioTube Claims Portal.

## What to do now
- Use only the claims portal linked from IoTeX's official site; ignore 'compensation' DMs and lookalike sites.
- Don't buy or trade the deprecated CIOTX minted during the attack.

## How to avoid this
- Bridges concentrate risk: keep only what you need bridged and prefer bridges whose upgrades need a multisig and a timelock.
- For teams: keep signing keys in hardware security modules or hardware wallets, never on staff laptops, and train staff against social engineering.

## Sources
- How IoTeX Responded to the ioTube Bridge Incident: A Full Month in Review (IoTeX, 2026-03-28): https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/

Full record: https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026 · JSON: https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.