IoTex has confirmed a major breach that drained millions from its cross-chain bridge. The attack happened on Saturday, the 21st of February, between 7:00 and 9:00 AM UTC. During that short window, the attacker gained control of IoTeX’s TokenSafe and MinterPool contracts and stole millions in crypto assets.
According to on-chain analyst Specter, who first flagged the suspicious transactions, about $4.3 million worth of tokens were drained initially. Some of the tokens still included USDC, USDT, IOTX, PAYG, WBTC, and BUSD.
Shortly after the theft, the attacker swapped most of the tokens into ETH and bridged around 45 ETH to the Bitcoin network, making it very hard to trace the funds. The initial drain was just a part of the whole damage that was caused.
How the Attacker Minted Millions Through Compromised IoTeX Contracts
After the hacker successfully took control of the contracts, they went on to mint new tokens. According to the report, about $4 million worth of CIOTX tokens and $4.5 million CCS tokens were created through the exploit.
Source: SpecterAnalyst (X)
The ‘creation’ caused the platform to lose almost $9 million. PeckShield confirmed the incident and stated that the IoTeX Bridge was hacked for more than $8 million due to a “compromised private key.”
The platform has also agreed that the attacker swapped the stolen funds into ETH and bridged them to Bitcoin through THORChain, a decentralized cross-chain protocol that helps to privately move assets to different blockchains.
Also Read: Crypto Scams Hit Millions in 2025–2026 Through Pig Butchering and Long-Term Fraud
So far, IoTex has officially released a statement to acknowledge the breach and confirm that the team is working in order to manage the situation. According to them, the actual loss may be lower than the figures circulating online.
IoTeX has shared that it is currently working with large exchanges and security teams to trace and freeze the stolen funds. Despite those assurances, IoTeX’s native token, IOTX, has fallen more than 7% within the last 24 hours.
Also Read: SBI Holdings Rolls Out ¥10B Security Token Bond With XRP Perks