Multichain(MULTI)

Date: Jul 10, 2021

Amount: $7.9m

Classification: Key Compromise

Technique: Weak Key Generation

On July 10, 2021, Anyswap/Multichain bridge was exploited when an attacker identified two V3 router transactions with identical ECDSA R values. This signature collision enabled reverse-calculation of the MPC private key, allowing unauthorized extraction of ~$7.8M across Ethereum, BSC, and Fantom.

Chains: Ethereum, BSC, Fantom

Bridge Hack

Language: Solidity

Target Type: CEX

Date: Jan 18, 2022

Amount: $1.4m

Classification: Input Validation

Technique: Missing Input Validation

Multichain's token contracts for WETH, PERI, OMT, WBNB, MATIC, and AVAX lacked proper validation of ERC20 permit() function calls. An attacker exploited this vulnerability to steal tokens from users who had previously granted approvals. A white-hat responder later returned approximately $1M of the $3M total loss, retaining 62 ETH as a bounty.

Chains: Ethereum

Language: Solidity

Target Type: DeFi Protocol

Date: Feb 15, 2023

Amount: $130,000

Classification: Input Validation

Technique: Signature Verification Flaw

On February 15, 2023, the AnyswapV4Router contract of Multichain was exploited via a front-running attack. The attacker exploited a lack of signature verification in the permit mechanism to front-run the anySwapOutUnderlyingWithPermit function and transfer WETH worth approximately 87 ETH ($130K) from the contract.

Chains: Ethereum

Bridge Hack

Language: Solidity

Target Type: DeFi Protocol

Date: Jul 7, 2023

Amount: $126m

Classification: Key Compromise

Technique: Validator Key Compromised

Multichain lost ~$126M on July 6-7, 2023 from bridge reserves on Fantom, Moonriver and Dogechain (WBTC, WETH, USDC, USDT, DAI, LINK and more). CEO Zhaojun, who held the MPC signing keys, had been detained since May 2023; project shut down days later.

Chains: Moonriver, BSC, Fantom

Bridge Hack

Target Type: DeFi Protocol