Breaches and incidentsBriefChecked against a primary source
IoTeX ioTube bridge: Validator contract owner key used for a malicious upgrade
21 Feb 2026: at least USD 4.4M per IoTeX’s revised write-up (first said about USD 2M; PeckShield estimated over USD 8M including minted assets).
- Disclosed
What happened
- 21 Feb 2026: at least USD 4.4M per IoTeX’s revised write-up (first said about USD 2M; PeckShield estimated over USD 8M including minted assets). About USD 4.3M drained from TokenSafe and about 111M CIOTX minted, much of it frozen.
- Root cause per Halborn citing IoTeX: a compromised private key of the account owning the Ethereum-side Validator contract, used to upgrade it and bypass validation and signature checks. How the key was obtained is not public.
- Attribution: none.
- Response: minted tokens frozen on IoTeX and BNB chains. Mainnet v2.3.4 with a blacklist. 10% bounty and 48-hour no-prosecution offer.
Sources
- https://halborn.com/blog/post/explained-the-iotex-hack-february-2026
- https://www.crowdfundinsider.com/2026/02/263392-iotex-suffers-private-key-compromise-in-bridge-infrastructure-co-founder-confirms-roughly-2-million-in-losses/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.