Back to all stories
Multichain Collapse: The Private Key Leak That Drained $125M+
1/8/2024
Project name: Multichain
Project type: Bridge
Date of exploit: July 6, 2023
Asset loss: More than $125M
Vulnerability: Private Key Issue
Date of audit report publishing:
- Nov 11, 2022: MultiChain Foundation - Cardano (Golang)
- Nov 21, 2022: MultiChain Foundation - Aptos (Move)
Conclusion: Out of Audit Scope
Details of the Exploit
Background
Multichain is a centralized cross-chain bridge protocol that allows users to bridge tokens between chains.
Nature of the Vulnerability
- The private key of Multichain is compromised, allowing the attacker to drain assets from the bridge protocol
CertiK Audit Overview
Conclusion
On July 6, 2023, the cross-chain bridge protocol Multichain experienced large unauthorized withdrawals, suggesting a likely Private Key issue.
It is identified as an out-of-scope issue since it is not an implementation bug.
Related Stories
Welcome to Hack3d: The Web3 Security Report for Q3 2024. Hack3d serves as an essential resource and record of statistics for understanding security challenges and vulnerabilities in the Web3 space. It equips stakeholders with the knowledge and insights needed to fortify their defenses and make informed decisions in an increasingly high-stakes environment.
10/2/2024
On 14th May, CertiK’s internal alerting system detected a suspicious transfer of $4.3 million worth of assets to a wallet on the Binance Smart Chain, with an additional 13.7 million STX worth $2 million that was transferred to a malicious address. The incident was due to a private key compromise of the project’s deployer which has been confirmed by the project since the attack. The funds that were affected on BSC were front run by a wallet who has begun negotiations to return the assets to the project. At the time of writing, the funds affected total $6.3 million.
5/16/2024
From 12 March to 16 March we have seen nine private key compromises (PKC) that have led to a combined loss of at least $22.96 million in March, with five of those incidents incurring losses over $1 million. These incidents showcase the continued devastation that private key leakages can have on the Web3 ecosystem which has already seen approximately $239 million lost to this type of attack in 2024.
3/22/2024
