IoTeX

On February 21, 2026, ioTube bridge's Ethereum-side Validator contract private key was compromised via social engineering targeting an employee. The attacker performed a malicious upgrade bypassing validation and signature checks, gaining control of TokenSafe and MintPool.

3M in USDC, USDT, IOTX, WBTC, and BUSD were drained within hours. Attackers were credited to the same group behind the Infini exploit.