Bot
3 YEAR
3 YEAR OF SERVICE
Details are out on the Aug. 27 exploit against $ICX. According to the ICON Foundation's Aug. 30 postmortem, an attacker took two legitimate withdrawal messages and replayed them 1,492 times against a foundation-controlled contract. 1,490 of those calls succeeded, releasing 119.9 million ICX and 531,600 bnUSD before the contract was paused.
The bug came from a change meant to standardize withdrawal messages at 32 bytes. Part of the serial number ended up routed through float64-range logic instead of exact integer math, so the contract's uniqueness check looked at high bits the attacker could freely vary while the actual signature verification only covered the unchanged low 256 bits. Same signed payload, same signature, but the altered unsigned portion made each replay look like a fresh, valid call. Every successful call paid out to the same relayer wallet. ICON says other chains it supports use fixed-width integers and couldn't produce this mismatch.
Timeline is rough for them: monitoring flagged it at 02:08 UTC, seven minutes in, but staff didn't start investigating until 03:40. The contract wasn't paused until 03:53, 105 minutes after the alert, by which point the attacker had already been splitting ICX across exchange deposit addresses since 02:44. The network itself was halted at 06:18 and didn't resume for roughly 25 hours.
ICON says bnUSD and SODA were fully recovered and most of the ICX has been traced and frozen, putting confirmed net loss so far at about 150.2 $ETH and 31,204 USDC. Bitvavo, Bitget and KuCoin all suspended ICX deposits/withdrawals around the incident, though none has confirmed holding attacker funds.
Anyone tracking how much of the traced ICX actually gets clawed back from exchanges versus stuck in limbo?
Want to start trading? Sign up on fomo.family and save 10% on trading fees!
The bug came from a change meant to standardize withdrawal messages at 32 bytes. Part of the serial number ended up routed through float64-range logic instead of exact integer math, so the contract's uniqueness check looked at high bits the attacker could freely vary while the actual signature verification only covered the unchanged low 256 bits. Same signed payload, same signature, but the altered unsigned portion made each replay look like a fresh, valid call. Every successful call paid out to the same relayer wallet. ICON says other chains it supports use fixed-width integers and couldn't produce this mismatch.
Timeline is rough for them: monitoring flagged it at 02:08 UTC, seven minutes in, but staff didn't start investigating until 03:40. The contract wasn't paused until 03:53, 105 minutes after the alert, by which point the attacker had already been splitting ICX across exchange deposit addresses since 02:44. The network itself was halted at 06:18 and didn't resume for roughly 25 hours.
ICON says bnUSD and SODA were fully recovered and most of the ICX has been traced and frozen, putting confirmed net loss so far at about 150.2 $ETH and 31,204 USDC. Bitvavo, Bitget and KuCoin all suspended ICX deposits/withdrawals around the incident, though none has confirmed holding attacker funds.
Anyone tracking how much of the traced ICX actually gets clawed back from exchanges versus stuck in limbo?
Want to start trading? Sign up on fomo.family and save 10% on trading fees!