IoTeX Offers 10% Bounty After $4.4 Million Cross-Bridge Hack
By John Nada·Feb 24, 2026·7 min read
IoTeX offers a 10% bounty for the return of $4.4 million stolen in a recent hack, emphasizing the need for improved security in cross-chain bridges.
IoTeX has offered a 10% bounty to hackers who exploited its cross-chain bridge, ioTube, siphoning approximately $4.4 million. The project’s co-founder and CEO, Raullen Chai, stated that they would not pursue legal action if the stolen funds are returned within 48 hours. This move aims not only to recover lost assets but also to mitigate further market disruption following the breach.
The hack, which occurred on February 21, 2026, involved a compromised validator owner private key, allowing unauthorized control over the bridge’s contracts. Chai emphasized that while the exploit impacted the Ethereum-side infrastructure, IoTeX’s Layer 1 blockchain remained secure. The company flagged and froze exchange deposits linked to the stolen funds and is rolling out an upgrade to its blockchain that includes a blacklist of malicious addresses.
Such incidents highlight ongoing vulnerabilities in cross-chain bridges, which have suffered significant exploits in recent years. Industry reports indicate that over $3.2 billion has been lost due to similar hacks, marking them as prime targets for malicious actors. As the crypto market grapples with these operational security failures, the responsibility of key custody remains crucial, and there's a growing call for improved security measures to prevent future breaches.
Chai told CoinDesk that the team sent an on-chain message offering not to pursue legal action or share identifying information with law enforcement if the remaining funds are returned. He remarked, "This is regarding the ioTube bridge exploit on Feb. 21, 2026. All fund movements across Ethereum, IoTeX, and bitcoin have been fully traced." This proactive approach by IoTeX illustrates the urgency of the situation and the company's commitment to recovering funds swiftly.
The incident came as a shock to the crypto community, especially considering that IoTeX is known for its focus on Internet-of-Things (IoT) devices, which rely heavily on secure and reliable blockchain infrastructure. Following the exploit, the company's native token, IOTX, experienced a significant drop in value, falling roughly 22% from $0.0054 to below $0.0042 before showing signs of partial recovery. Such volatility underscores the immediate impact of security breaches on investor confidence and market stability.
The offer of a 10% bounty, amounting to $440,000, aligns with a growing trend in the crypto space where projects incentivize hackers to return stolen funds rather than pursuing legal recourse. This strategy has seen mixed results in the past; some hackers have returned funds, while others have disappeared with them. Notably, the message from IoTeX also indicates that the company has flagged and frozen exchange deposits linked to the stolen assets, showcasing their active measures to prevent further loss and ensure accountability.
IoTeX's co-founder and CEO, Raullen Chai, noted that they are rolling out a new version of their blockchain, Mainnet v2.3.4, which will require node operators to upgrade. This upgrade will include a built-in blacklist of malicious externally owned account (EOA) addresses, which is a critical step in fortifying the network against similar threats in the future. Chai stated, "This blacklist contains a list of malicious or problematic EOA addresses that will be filtered by the node," highlighting the seriousness of the breach and the measures being taken to safeguard user assets moving forward.
Experts in the field, including Nick Motz, CEO of ORQO Group and CIO of Soil, discussed the implications of the breach, emphasizing that it was more an operational security failure rather than a flaw in the smart contracts themselves. He explained, "The breach came down to a compromised validator owner private key on the Ethereum side, which is fundamentally an operational security failure, not a smart contract vulnerability discovered by an outside actor." This distinction is crucial as it shifts some of the responsibility back onto the organization for their key management practices.
The discussion around key custody is a pertinent one in the crypto world. Nanak Nihal Khalsa, co-founder of human.tech, pointed out that the responsibility for securing private keys ultimately lies with whoever holds them. He remarked, "Yes, whoever holds the private key is responsible for securing it. Is that a reasonable responsibility? It’s hard to say. But that’s how the industry works right now." This sentiment reflects the ongoing challenges in the industry regarding liability and security, particularly as it pertains to individual users versus centralized entities.
As the analysis of the hack continues, on-chain analysis by security firm PeckShield estimated that more than $8 million worth of assets were affected, raising concerns over the magnitude of the breach. The attacker reportedly swapped stolen funds into ether (ETH) and began bridging them to bitcoin (BTC) via THORChain, complicating recovery efforts. The firm stated, "The hacker has swapped the stolen funds to $ETH and has started bridging them to #BTC via #Thorchain," indicating the sophisticated tactics employed by the hacker.
Another on-chain investigator, Specter, suggested that the private key of the IoTeX network may have been compromised, which led to an estimated loss of $4.3 million. This ongoing investigation suggests that the breach was not a simple theft but rather a calculated attack that may have exploited weaknesses in the system’s operational security. Motz expressed skepticism about the recovery of the assets, stating, "Containment is not the same as recovery. The assets with actual market value were swapped and bridged. Those are, in my assessment, unlikely to be recovered."
The uncertainty surrounding recovery was echoed by Khalsa, who cautioned that the prospects for recovering stolen funds remain dubious. He acknowledged, "It’s hard to predict how much, if any, can be recovered." This uncertainty highlights the harsh reality of the crypto landscape, where security breaches can lead to substantial financial losses with little recourse for affected parties.
IoTeX has since revised its figure on the loss upward to approximately $4.3 million, reflecting the direct asset drain while excluding minted tokens. This revision indicates the fluid nature of valuations in the aftermath of such breaches and the complexities involved in assessing total losses accurately. Motz commented, "Private key compromise rather than smart contract bugs is emerging as a dominant attack vector," emphasizing a trend that could have significant implications for future security protocols.
With the rise of sophisticated attacks targeting operational security rather than just technical vulnerabilities, the industry is urged to rethink its approach to security. There is a growing consensus that stronger wallet and multisig setups are needed to reduce the risks associated with key custody. As highlighted by industry experts, the norms surrounding liability in crypto remain unsettled compared to traditional finance, necessitating a reevaluation of security practices.
The incident serves as a stark reminder of the vulnerabilities present in cross-chain bridges, which have become one of crypto’s main failure points. As the industry continues to mature, there is a pressing need for enhanced security measures, clearer liability norms, and better user education to mitigate risks in the future. The call for improved security in the crypto ecosystem is louder than ever, as both projects and users seek to navigate the complex landscape of digital assets with greater confidence and security.
The developments surrounding IoTeX's hacks, paired with broader trends in the crypto space, highlight the critical need for collaboration among projects to establish robust security frameworks. As the industry grapples with these challenges, the importance of fostering a secure environment for all stakeholders becomes paramount, ensuring that the innovations of blockchain technology can be harnessed safely and effectively for the future.