SunSec (@1nf0s3cpt) “🚨 $24.15M USDC drained from an Arbitrum bridge — — 5 compromised keys 5 hot-val”

2026.07.23 00:08

🚨 $24.15M USDC drained from an Arbitrum bridge — — 5 compromised keys 5 hot-validator signatures carried 7,142/10,000 power (>2/3 quorum). The contract did exactly what it was told — the keys were the weak point. Two-phase attack, both traced on-chain: 1⃣ Propose (carries the 5 sigs + full 7-validator set, powers sum to 10,000) 2⃣ 200s dispute window → Execute (releases 24.15M USDC, bridged out via CCTP) Sigs are in the propose tx, not the withdrawal tx 👇 Propose: Execute: Stolen funds: 0x627654B2782bfC57580ecD11d40869b350B6ebAC now on ETH chain. 12,467.43703738 ETH

显示更多