ICON replay exploit triggers 119,866,000 ICX release through 1,492 message reuses

The Aug. 27 ICON replay exploit resulted in the release of 119,866,000 ICX and 531,600 bnUSD from foundation-held assets after two legitimate withdrawal messages were reused 1,492 times. A postmortem indicated that 1,490 calls succeeded, with no user deposits or balances accessed. The net loss was estimated at about 150.2 ETH plus 31,204 USDC, with most ICX traced and frozen. bnUSD and SODA were fully recovered, but exchange-held amounts are still under review. The exploit allowed the attacker to alter part of a withdrawal identifier without changing the signed payload, leading to a mismatch in the uniqueness check. ICON's monitoring system detected the exploit at 02:08 UTC, seven minutes after it began, with technical staff starting their investigation at 03:40. The affected contract was paused at 03:53, 105 minutes after the alert. The attacker began distributing ICX across exchange deposit addresses at 02:44, continuing until about 05:20. The network was halted at 06:18:54 and resumed at approximately 07:51 the next day. ICX deposits and withdrawals were suspended by exchanges like Bitvavo, Bitget, and KuCoin around the incident.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.