IoTeX ioTube bridge compromise drains about US$4.4 million and mints 410 million CIOTX; users being compensated
IoTeX's ioTube bridge was hijacked on 21 Feb 2026: about US$4.4m of reserves stolen, 410m CIOTX minted, chain paused for three days. Most minted tokens frozen; no stolen total recovered is reported. Bridge users can claim compensation. Nothing for other IOTX holders to do.
Nothing for most people to do. If you used the ioTube bridge from Ethereum and lost assets, file a claim through IoTeX's official claims portal, reached from IoTeX's own website, and be wary of anyone contacting you offering to recover funds.
What’s happening
On 21 February 2026 an attacker took control of the account that owns the Ethereum-side validator contract for IoTeX's ioTube bridge. They swapped in a malicious version that skipped the bridge's checks, then drained about US$4.4 million of reserve assets (IoTeX's figure) and minted 410 million CIOTX tokens. Outside estimates reported by The Block went as high as US$8.8 million, which IoTeX disputed. IoTeX paused its blockchain that morning and restarted it on 24 February with an update that froze attacker wallets. It says over 86% of the minted tokens were locked or frozen and the IoTeX chain itself was not compromised. The stolen reserves were turned into ether and partly moved to Bitcoin. IoTeX's own account does not state how much stolen money has been recovered. It filed reports with the FBI and other agencies, and no arrests or charges are reported in the sources read. The IoTeX Foundation opened a claims portal on 2 March, paying users up to US$10,000 in full and the rest over 12 months. The bridge stays suspended pending an independent audit, and CIOTX is being retired. Two accounts of how the attacker got in differ: a compromised key (The Block) versus a compromised employee machine (IoTeX).
- What
- Breach
- Affects
- IoTeX ioTube cross-chain bridge (Ethereum side)
- Fixed in
- Nothing to patch
- Since
- 21 Feb 2026
- Closed
- 28 Mar 2026
Timeline
- Update
IoTeX's month-in-review said the claims portal had launched on 2 March and payouts were beginning. It did not state any total recovered from the attacker. CIOTX was permanently deprecated on several chains and the bridge audit was underway.
- Update
IoTeX's third update said a 10% white-hat bounty offer closed on 25 February, and four Bitcoin addresses holding 66.78 BTC remained unspent and monitored. It set out a compensation plan: affected users up to US$10,000 paid in full, and larger balances paid over 12 months after the first US$10,000.
- Update
The IoTeX chain restarted at 06:06 UTC with mainnet v2.3.4, which blacklisted 29 attacker wallets and permanently froze about 45 million IOTX in them. Reports were filed with the FBI and other law enforcement.
- Update
IoTeX published its incident update. The Ethereum-side bridge contracts were affected, but the IoTeX chain itself was not compromised. It said over 86% of the minted tokens were locked or being frozen, that the stolen reserves had been converted to about 2,183 ETH, and that about 1,572 ETH had been bridged to Bitcoin. ioTube stays suspended until an independent audit is done.
- Made public
According to IoTeX's later review, the attacker upgraded an ioTube Validator contract on Ethereum to a malicious version. This let them drain about US$4.4 million of bridge reserves and mint 410 million CIOTX tokens.
- Update
IoTeX detected the breach at 08:01 UTC and validators paused the IoTeX chain at 10:03 UTC. The Block reported independent estimates of up to US$8.8 million, which IoTeX disputed, and noted IoTeX's co-founder put the loss at about US$2 million.
Sources
- Security Incident Update: ioTube Bridge Exploit and Recovery RoadmapIoTeX · 23 Feb 2026
- ioTube Security Incident Update No.3: Full Recovery & Compensation PlanIoTeX · 6 Mar 2026
- How IoTeX Responded to the ioTube Bridge Incident: A Full Month in ReviewIoTeX · 28 Mar 2026
- IoTeX hit by private key exploit draining up to $8.8 million from bridge contractsThe Block · 21 Feb 2026