{
 "tag": "iotex",
 "name": "Iotex",
 "group": "Other",
 "incidents": [
  {
   "slug": "iotex-iotube-bridge-key-compromise-feb-2026",
   "title": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026",
   "json": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "IoTeX ioTube bridge (Ethereum side)",
   "tags": [
    "ethereum",
    "key-leak",
    "iotex",
    "iotube",
    "bridge",
    "social-engineering",
    "validator-key",
    "malicious-upgrade"
   ],
   "amountUsd": 4400000,
   "victims": null,
   "startedAt": "2026-02-21",
   "closedAt": "2026-02-24",
   "updatedAt": "2026-03-28T12:00:00Z",
   "summary": "On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users."
  }
 ],
 "changes": [
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-28",
   "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-02",
   "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-24",
   "title": "The IoTeX chain came back online at 06:06 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-21",
   "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-21",
   "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  }
 ]
}