{
 "tag": "bridge",
 "name": "Bridge",
 "group": "Other",
 "incidents": [
  {
   "slug": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "title": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026",
   "json": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc"
   ],
   "method": "key-leak",
   "product": "SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)",
   "tags": [
    "ethereum",
    "bsc",
    "key-leak",
    "bridge",
    "cloud-compromise",
    "signing-key",
    "unauthorized-mint",
    "singularitynet",
    "asi-alliance",
    "nunet",
    "fet",
    "agix"
   ],
   "amountUsd": 2290000,
   "victims": null,
   "startedAt": "2026-09-19",
   "closedAt": null,
   "updatedAt": "2026-09-25T12:00:00Z",
   "summary": "An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps."
  },
  {
   "slug": "humanity-protocol-dev-machine-keys-jun-2026",
   "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026",
   "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc"
   ],
   "method": "key-leak",
   "product": "Humanity Protocol (H token) bridges and treasury",
   "tags": [
    "ethereum",
    "bsc",
    "key-leak",
    "humanity-protocol",
    "malware",
    "infostealer",
    "developer-machine",
    "gnosis-safe",
    "multisig",
    "bridge",
    "h-token"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-06-15",
   "updatedAt": "2026-06-15T12:00:00Z",
   "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools."
  },
  {
   "slug": "iotex-iotube-bridge-key-compromise-feb-2026",
   "title": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026",
   "json": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "IoTeX ioTube bridge (Ethereum side)",
   "tags": [
    "ethereum",
    "key-leak",
    "iotex",
    "iotube",
    "bridge",
    "social-engineering",
    "validator-key",
    "malicious-upgrade"
   ],
   "amountUsd": 4400000,
   "victims": null,
   "startedAt": "2026-02-21",
   "closedAt": "2026-02-24",
   "updatedAt": "2026-03-28T12:00:00Z",
   "summary": "On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users."
  }
 ],
 "changes": [
  {
   "incident": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-25",
   "title": "Rekt reported SingularityNET had revoked the access, shut the bridges and converters, paused AGIX and NTX transfers on Ethereum and planned to retire AGIX; the attacker's hub still held about 433 ETH.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026"
  },
  {
   "incident": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-20",
   "title": "Unauthorized minting began around 03:13 UTC, creating about 2.3 billion AGIX, NTX, WMTX and CGV.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026"
  },
  {
   "incident": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-19",
   "title": "A compromised authorizer signature released 8,721,530.40 FET from the bridge, cleared at 20:21 UTC, which the attacker swapped for 522.78 ETH.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-15",
   "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.",
   "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-09",
   "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-08",
   "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-28",
   "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-02",
   "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-24",
   "title": "The IoTeX chain came back online at 06:06 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-21",
   "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-21",
   "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  }
 ]
}