Home›Crypto›Market Structure›ICON pauses chain after replay exploit lets attacker t…

ICON pauses chain after replay exploit lets attacker trigger withdrawals

ICON said the replay exploit released 119,866,000 ICX and 531,600 bnUSD from foundation-held assets, while ICON later set net loss to about 150.2 ETH plus 31,204 USDC.

Reported · Written up by our desk · Market Structure

CryptoSlate reports that ICON, the ICON Foundation, investigated an Aug. 27 replay exploit that involved reusing the same authorization message across withdrawals. In its Aug. 30 postmortem, ICON said the exploit released 119,866,000 ICX and 531,600 bnUSD from foundation-held assets after two legitimate withdrawal messages were reused 1,492 times.

According to the postmortem, 1,490 replay calls succeeded, but no user deposits, balances, or positions were accessed. ICON emphasized that the headline-sized ICX release is not the same as confirmed loss, and it put net loss to date at about 150.2 ETH plus 31,204 USDC, with most ICX traced, frozen, and in active recovery.

CryptoSlate also notes that ICON traced the issue to a mismatch between a withdrawal identifier and the uniqueness check, tied to how part of a serial number was routed through float64-range logic rather than exact integer arithmetic. ICON said two calls reverted, and every successful call credited the same relayer wallet.

ICON said it paused the affected contract at 03:53, about 105 minutes after an alert that monitoring fired at 02:08 UTC, and staff began investigating around 03:40. The foundation said an ICON-side pause could not stop movement of funds already swept into exchange custody, and it reported that the network was halted at 06:18:54 and resumed about 25 hours later, with Bitvavo, Bitget, and KuCoin posting notices that ICX deposits and withdrawals were suspended around the incident.

Latest closeEthereum $2,418.74 ▼1.9%

More like this

Sources