IoTeX Hit by $2M–$4M Exploit After Private Key Compromise

Steady attention without excessive speculation.

• IoTeX bridge users and token holders saw temporary service disruption and a 9-10% IOTX token price decline following the breach
• Users of IoTeX’s main chain were unaffected as the team confirmed main chain funds remained secure throughout the incident
• Cryptocurrency exchanges working with IoTeX to freeze and trace stolen funds as they move through centralized platforms

What the Attacker Did

After gaining control of the token safe, the attacker moved quickly.

First, they drained an estimated $4.3 million in assets from the vault. Tokens involved included USDC, USDT, IOTX, PAYG, WBTC, and BUSD.

Next, the attacker swapped the tokens into ETH on decentralized exchanges such as Uniswap.

Then, they bridged approximately 45 ETH to Bitcoin via THORChain. This step likely aimed to obscure the trail and complicate recovery efforts.

In addition, the attacker minted roughly 111 million unauthorized CIOTX tokens and drained 9.3 million CCS tokens. However, IoTeX later clarified that many of these assets were deprecated, frozen, or had limited real-world value.

While early analyst estimates suggested total exposure of $8–8.8 million, IoTeX’s official confirmed loss stands closer to $2 million. That figure reflects primarily liquid assets such as USDC, USDT, IOTX, and WBTC.

Src: X (CryptoPatel)

Immediate Response From IoTeX

IoTeX responded quickly and publicly.

Within hours, the team confirmed suspicious activity and assured users that losses were lower than circulating rumors. They coordinated immediately with centralized exchanges and security partners to trace and freeze stolen funds.

Co-founder Raullen Chai emphasized that all funds on the main IoTeX chain remained safe. The compromise affected only the token safe and bridge infrastructure.

To contain the situation, the team:

• Temporarily secured and paused the IoTeX blockchain
• Froze and upgraded affected contracts, including CIOTX
• Coordinated with exchanges and law enforcement
• Engaged security firms such as PeckShield for forensic analysis

By the evening of February 21, IoTeX confirmed the breach was contained. The team stated that full chain operations and exchange deposits would resume within 24 to 48 hours following final upgrades.

Current Status

As of February 22, 2026:

• The incident remains contained
• No new suspicious activity has been reported
• Chain operations are expected to resume within the announced window
• Recovery efforts continue
• The root cause investigation remains ongoing

Meanwhile, the IOTX token fell roughly 9–10% following the announcement, reflecting short-term market reaction rather than systemic protocol failure.

Why This Matters

Importantly, no user funds on the main IoTeX chain were directly at risk. However, the incident highlights a recurring vulnerability in crypto infrastructure: private key compromise in bridge and multi-sig setups.

Throughout 2025, private key attacks accounted for a significant share of crypto losses. IoTeX’s exploit follows a familiar pattern:

1. Drain assets
2. Swap to ETH
3. Bridge cross-chain
4. Convert to Bitcoin

The speed of execution suggests experienced operators.

Loading chart...

The Bigger Picture

IoTeX’s response has been relatively transparent and proactive. Still, the event reinforces an ongoing industry challenge.

Bridges and token safes remain high-value targets. Even mature projects face operational key management risks.

Now, the focus shifts to three questions:

• How was the private key compromised?
• Can meaningful funds be recovered?
• What structural upgrades will prevent recurrence?

IoTeX says further updates will follow as the forensic investigation concludes.

$0.00