ChainSwap Exploit Hit 20 Assets and Forced Its Bridge Offline

ChainSwap took its cross-chain bridge offline on July 11, 2021, after an attacker exploited its token-minting logic across assets connected between Ethereum and Binance Smart Chain. ChainSwap’s later incident report counted 20 affected assets and assigned them a combined value of $4 million.

The exact boundary of the incident requires care. ChainSwap dated the exploit to July 11, while Razor Network, one affected project, said on July 11 that the attack began at about 20:00 UTC on July 10. The defensible July 11 development is therefore the public discovery, containment and project-wide response to an attack that had begun late on July 10 under the UTC clock.

That response mattered beyond the loss estimate. Bridges custody or represent assets across otherwise separate blockchains. A flaw in the bridge’s authorization logic could therefore damage many token projects at once, even when their own core contracts were not the original point of failure.

A quota check became a minting path

ChainSwap’s post-mortem attributed the exploit to a logical flaw in its token cross-chain quota code. The system allowed a signature node to increase a bridge quota automatically. According to ChainSwap, invalid addresses that were not whitelisted could nevertheless trigger that increase.

Contemporaneous reporting described the practical result: the attacker obtained control over mapped token contracts on Binance Smart Chain, minted tokens to the attacker’s address and sold some through PancakeSwap. That description is consistent with ChainSwap’s later identification of the attacked contract and attacker address, but the public record did not establish the attacker’s identity.

This was not a theft of one homogeneous reserve asset. It was a shared-infrastructure failure that created or released multiple project tokens and exposed the liquidity supporting them. The $4 million figure was ChainSwap’s own combined valuation, not an independently audited cash-loss statement. It could not capture every holder’s slippage, every canceled trade or the cost of replacing tokens.

Projects moved to contain secondary damage

ChainSwap said the bridge was offline and mapped tokens had been frozen while it contacted affected projects and developed compensation plans. On July 11, project teams separately reported removing decentralized-exchange liquidity, taking holder snapshots and preparing replacement tokens or other remediation.

Those measures were defensive but disruptive. Pulling liquidity could prevent newly minted tokens from being dumped into pools, yet it also reduced ordinary holders’ ability to trade. Freezing mapped tokens could limit further movement while also showing that some project administrators retained controls capable of restricting transfers. Snapshots and proposed token replacements introduced additional questions about cutoff times, exchange balances and which holders would qualify.

The July 11 incident also followed a separate ChainSwap exploit on July 2. ChainSwap’s July 4 report estimated that earlier damage at about $800,000 and said the bridge had been frozen, nodes shut down and a fix deployed. A second failure within nine days made the July 11 response an institutional test of whether audits, emergency controls and compensation promises could restore confidence in shared bridge infrastructure.

What was established on July 11

By the end of July 11, the reliable record established a multi-project exploit, an offline bridge and emergency action by affected teams. It did not establish a final reconciled loss, full compensation or a safe reopening. ChainSwap’s detailed root-cause and $4 million account appeared on July 12 and should be read as a project-authored post-mortem, not an independent audit.

Later context

A British Virgin Islands Commercial Court judgment issued in May 2022 later described two July 2021 ChainSwap attacks about a week apart. The court said the second attack removed a quota restriction so tokens could be minted without corresponding deposits. That later judicial account corroborates the mechanism, but it was not information available to market participants on July 11, 2021.