IoTeX’s cross-chain bridge was hit by a private key exploit on February 21, draining over $8 million in crypto assets and sending the IOTX token tumbling. The attack, which unfolded between 7 and 9 AM UTC, gave the hacker control over IoTeX’s TokenSafe and MinterPool contracts.
On-chain analyst Specter was among the first to flag the breach, reporting that the attacker drained $4.3 million in tokens including USDC, USDT, IOTX, PAYG, WBTC, and BUSD. The stolen assets were quickly swapped to ETH, with approximately 45 ETH bridged to the Bitcoin network.
But that was only part of the damage.
Attacker Minted Millions in CIOTX and CCS Tokens
Beyond the initial drain, the hacker exploited the compromised contracts to mint $4 million in CIOTX tokens and $4.5 million in CCS, pushing total estimated losses toward $9 million.
Blockchain security firm PeckShield confirmed the exploit on X, writing: “The IoTeX Bridge has been hacked for over $8M worth of crypto due to a compromised private key. The hacker has swapped the stolen funds to $ETH and has started bridging them to BTC via THORChain.”
Three attacker addresses have been publicly identified so far.
IoTeX Says Actual Losses Are Lower
IoTeX confirmed the breach by 10:30 AM UTC and pushed back on the circulating estimates. The team stated that “initial estimates indicate the potential loss is significantly lower than circulating rumors suggest.”
The company added that it has “already coordinated with major exchanges and security partners, which are actively assisting in tracing and freezing the hacker’s assets.”
IOTX Price Reacts to the Exploit
IOTX is currently trading near $0.0049, down 9.2% over the last 24 hours, with daily volume surging over 507%.
This incident follows a rough stretch for cross-chain bridges in 2026. Just three weeks ago, CrossCurve lost $3 million in a separate bridge exploit, and January alone saw nearly $400 million in total crypto thefts industry-wide.
IoTeX says the situation is “under control” and has promised continued updates. Analysts are now watching whether the frozen funds can be recovered before the attacker moves them further.
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
