What Happened to the IoTeX Bridge? The $8.8M Hack Explained (2026)

If you have seen headlines about the IoTeX bridge being hacked, you have probably also noticed that the loss figures never seem to agree. Some say $2 million, others say $4.4 million, and some say over $8 million. That is not a coincidence — the different numbers come from different sources counting different things, and they all appeared within hours of each other on the morning of February 21, 2026.

This guide walks you through what happened to the IoTeX bridge in plain English, explains why the reported numbers disagree, and shows you how to verify incident claims like this yourself before you trust them with your money. You will learn the confirmed timeline, the honest limits of what we know, and the practical lessons for anyone who bridges tokens between chains.

id=”the-reported-incident”>The reported incident: what happened on February 21

On the morning of February 21, 2026, between roughly 7 and 9 AM UTC, on-chain analysts began flagging suspicious activity on IoTeX’s ioTube cross-chain bridge. The first public alert came from an on-chain analyst known as Specter, who reported that a large amount of tokens — including USDC, USDT, IOTX, PAYG, WBTC, and BUSD — had been drained from the bridge’s contracts. Within about ninety minutes, the blockchain security firm PeckShield confirmed the exploit, reporting that the IoTeX bridge had been hacked for over $8 million worth of crypto due to a compromised private key, and noting that the attacker had swapped stolen funds to ETH and begun bridging them to Bitcoin via THORChain.

Three attacker addresses have been publicly identified so far, and on-chain tracing shows the stolen assets being swapped into ETH, with at least 45 ETH moved to the Bitcoin network. The exploit unfolded entirely on the Ethereum side of the bridge: the attacker gained control of a validator’s private key there, which gave them administrative control over the bridge’s TokenSafe and MinterPool contracts — the exact contracts that held users’ real bridged assets and controlled token issuance.

The following details are widely reported and consistent across independent sources:

• The incident occurred on February 21, 2026 — the date is consistent across reports, with one archival source listing it under a February 21 record.
• The root cause was a compromised private key, not a clever smart-contract exploit. The attacker obtained the owner key to the ioTube validator contract on Ethereum.
• The attacker used that key to upgrade the bridge’s validator contract to a malicious version that bypassed signature checks.
• With control established, the attacker drained real bridged assets from the TokenSafe contract and minted hundreds of millions of unbacked CIOTX tokens (CIOTX is the cross-chain representation of IOTX).
• The stolen assets were swapped to ETH and moved toward Bitcoin via THORChain, making them harder to freeze and trace.
• IoTeX confirmed the exploit and said user funds held directly on the IoTeX chain were not affected — the damage was limited to bridge infrastructure.

One more confirmed fact: major exchanges, including Binance, Upbit, Bithumb, and KuCoin, temporarily suspended IOTX deposits and withdrawals as a precaution right after the incident. Trading on Binance has since resumed.

Why the loss numbers don’t agree ($2M vs $4.4M vs $8M+)

Here is the honest part most coverage glosses over: the “$8.8M” in headlines and the various competing figures are reported estimates from different parties, and none of them are wrong — they are simply counting different things. When you see conflicting numbers for the same hack, this is almost always why.

Why such a spread? The attacker did two distinct things: they drained real assets (stablecoins, WBTC, ETH) from the TokenSafe contract, and they minted 410 million unbacked CIOTX tokens on top of that. Counting the real drained assets gives you roughly $4.4 million in analyst reconstructions — or around $2 million in the team’s own accounting, which said “the exploit impact is around $2M” and that “potential loss is lower than circulating rumors suggest.” Counting the full damage including minted and swapped value gets you to PeckShield’s “over $8M.” The “$8.8M” headline figure represents the upper end of those estimates, not a single audited loss figure.

The green callout below captures the practical takeaway from all of this number-counting:

How the attack worked, in plain English

The IoTeX incident is a textbook example of the simplest possible bridge failure: one compromised key. There was no zero-day exploit, no flash loan, no clever math. Here is the sequence in plain terms.

Step one: the key fell into the wrong hands. IoTeX’s ioTube bridge, like most cross-chain bridges, relied on a validator contract on the Ethereum side to approve transfers. The private key that controlled that validator contract was compromised. The team described it as a “long-planned attack by professional actors targeting multiple chains.” How the key was obtained has not been publicly established — we know it was compromised, not exactly how.

Step two: the attacker upgraded the contract. With the owner key, the attacker swapped the bridge’s validator contract for a malicious version that bypassed signature checks. This is the crucial point: whoever holds the upgrade key effectively holds the whole bridge. This is exactly the “upgrade-safety” risk that auditors warn about — a single privileged key can rewrite the rules of the contract at any time.

Step three: drain the real assets. With administrative control over the TokenSafe and MinterPool contracts, the attacker withdrew real bridged assets: USDC, USDT, WBTC, IOTX, and others — roughly $4.4 million by analyst estimates, $2 million by the team’s count.

Step four: mint counterfeit tokens. The attacker also exploited the minting authority to create 410 million unbacked CIOTX tokens — worthless counterfeit versions of IoTeX’s cross-chain token. These had no backing and were essentially printed out of thin air.

Step five: launder through other chains. The real stolen assets were swapped to ETH and partially bridged to Bitcoin via THORChain — a deliberate move to make the funds harder to freeze and trace.

What the ioTube bridge was for

ioTube was IoTeX’s cross-chain bridge — a tool that let users move assets between the IoTeX network and other blockchains such as Ethereum and BNB Smart Chain. If you held USDC on Ethereum and wanted to use it inside the IoTeX ecosystem, ioTube was the official way to do it: you deposited tokens on one side, and the bridge minted a wrapped representation (like CIOTX for IOTX) on the other side.

Bridges like this hold enormous amounts of real user assets in their TokenSafe contracts — which is precisely why a single compromised key is catastrophic. Whoever controls the key controls the vault. ioTube worked the same way as dozens of other bridges that have suffered similar fates: Ronin, Wormhole, and Nomad all involved either compromised keys or contract logic that gave an attacker administrative control. The IoTeX case fits squarely in that pattern, which is worth remembering because it tells you what to look for in any bridge, not just this one.

The team’s response and compensation plan

IoTeX’s response followed a now-familiar incident playbook, and most of these details are confirmed in public statements:

• Chain upgrade: The team upgraded the IoTeX mainnet to version v2.3.4 on February 23, which included a default blacklist of malicious attacker addresses and other security hardening. This allowed the chain to resume full operations safely.
• Exchange coordination: Binance, Upbit, Bithumb, KuCoin, and other exchanges temporarily suspended IOTX deposits and withdrawals as a precaution. Binance has since resumed IOTX trading.
• Compensation promise: The IoTeX Foundation promised 100% full compensation to all affected bridge users, regardless of whether stolen funds are recovered. A Claims Portal launched around February 27–28, 2026, where users submit proof such as transaction hashes and wallet information for verification and payout. The program reportedly worked in two tiers, with smaller losses (up to $10,000) paid out immediately in full.
• White-hat bounty: IoTeX offered a 10% “white hat” bounty — $440,000 — for the return of funds within 48 hours. The stolen assets remain largely unrecovered, mostly laundered into ETH and BTC.
• Law enforcement: The team said it coordinated with exchanges and law enforcement to freeze stolen funds, describing the incident as a long-planned attack by professional actors targeting multiple chains.

One thing worth noting: the team’s confirmed loss figure (~$2M) was substantially lower than analyst estimates. This is common — teams count what they can verify as gone from their contracts, while analysts count everything that moved, including minted tokens and assets whose backing is unclear. Both perspectives are useful, and neither should be treated as the complete picture on its own.

How to verify bridge-hack claims yourself

The IoTeX story is a perfect case study for a skill every crypto user needs: verifying an incident claim before acting on it. Here is a practical checklist you can use the next time you see a “bridge hacked for $X million” headline.

1. Check who reported it first. In this case, an on-chain analyst (Specter) flagged it, then a security firm (PeckShield) confirmed it. A claim that starts with an independent on-chain analyst and gets confirmed by a named security firm is much more reliable than a claim that only exists in crypto-news aggregation.
2. Compare the numbers and what they count. If PeckShield says $8M+ and the team says $2M, look for the breakdown: real drained assets vs. minted counterfeit tokens vs. total funds exposed. Conflicting numbers usually mean different accounting, not dishonesty.
3. Look for the official response. Type the project’s official site address yourself (never click links in news comments) and check for a post-mortem or incident statement. IoTeX published statements confirming ~$2M and describing its response. No official statement after 48+ hours of claims is itself information.
4. Check exchange behavior. When Binance, Upbit, Bithumb, and KuCoin all suspend IOTX deposits and withdrawals simultaneously, that is a strong independent signal that something real happened — exchanges act on confirmed risk, not rumors.
5. Verify on-chain, if you can. Block explorers (type the address yourself — for Ethereum it is the one everyone knows, for IoTeX use its native explorer) let you inspect the bridge’s TokenSafe contract and the attacker addresses. You do not need to read code: large outflows to unknown addresses on the incident date are visible to anyone.
6. Beware the panic-withdrawal scam. After a real hack, scammers create fake “emergency withdrawal” sites and push them through ads and social posts. Never connect your wallet to an “emergency” site you found through a search ad — go to the project’s official channels by typing the address yourself. For a full walkthrough of this pattern, see our 5-step bridge safety check.

Safer bridging habits after the IoTeX incident

The IoTeX hack teaches five durable lessons that apply to every bridge you will ever use:

1. Prefer bridges with decentralized validator sets. A bridge controlled by a single key is a single point of failure. Bridges with large, rotating validator sets or zero-knowledge proofs are structurally safer than single-key or small-multisig bridges.
2. Never bridge more than you can afford to lose. Bridge failures are not rare — Ronin, Wormhole, Nomad, and now ioTube all lost nine or eight figures. Treat every bridge deposit as at-risk funds.
3. Research the bridge’s trust model first. Check who can upgrade the contracts, how many keys are involved, whether the code is audited, and whether the team has a bug bounty. This takes fifteen minutes and is the single highest-value safety habit in crypto.
4. Move fast but verify faster. If you have funds in a bridge when an incident is reported, do not panic-click links. Go to the official site by typing the address yourself, check the project’s official announcements, and only then act.
5. Watch for airdrop and compensation scams. After hacks, scammers impersonate compensation portals. The real IoTeX Claims Portal was announced through official channels — any “claim your compensation” site you found through an ad or a DM is fake. Our coverage of the reported Symbiosis incident and the reported Echo Protocol incident covers the same verification discipline.

FAQs

The Bottom Line

What happened to the IoTeX bridge is confirmed: a compromised private key gave an attacker administrative control of the ioTube bridge’s contracts on February 21, 2026, leading to real losses that the team puts at around $2M and analysts estimate at $4.4M or more. The headline “$8.8M” figure is a reported upper bound, not an audited loss. The deeper lesson is structural — a single compromised key handed over the keys to everything the bridge was supposed to protect — and it applies to every bridge you will ever use. Verify incident claims with independent sources, count what each number actually measures, and never panic-click “emergency” links.

This guide is for education only — not financial advice.