IOTA Keeps Value Transfers Frozen as Trinity Wallet Theft Probe Widens

The IOTA Foundation kept value transfers on its main network suspended on February 13, 2020, while investigating reports that funds had been removed from users of its Trinity wallet. Two Foundation updates dated February 13 said the suspected cause remained unresolved, but the evidence then available pointed toward stolen wallet seeds rather than a demonstrated failure of IOTA’s core protocol.

The distinction mattered, but it did not make the disruption minor. By stopping the Coordinator—the Foundation-operated component whose milestones confirmed transactions—IOTA prevented new value transfers from receiving confirmation. Data transactions were not affected, according to the Foundation, but holders could not conduct normal token transfers while the halt continued.

What was known on February 13

The incident began on February 12, when the Foundation received several reports of unusual fund thefts and advised users to keep Trinity closed. Its status record says it stopped the Coordinator at 17:20 on February 12 to prevent further theft while investigators searched for the cause.

On February 13, the Foundation said roughly 10 victims who had identified themselves all appeared to have used Trinity recently. It characterized that count as provisional and said the available evidence was inconclusive. Investigators were considering several possible causes, including an exploit involving an earlier Trinity release or one of its software dependencies.

A later February 13 update said cyber-forensics specialists had joined the investigation and that the Foundation was manually verifying attack-pattern analysis produced with newly developed tools. The Foundation also reported that the first exchanges to respond had found no monitored funds transferred or liquidated through their platforms. That was a contemporaneous institutional claim, not an independently complete accounting of the stolen assets or every exchange.

CoinDesk’s report published on February 13 corroborated the operational facts: Trinity users had reported thefts, the Coordinator had been switched off, and the Foundation was examining a possible wallet exploit. The report also reflected the uncertainty still surrounding the number of affected users and the attack’s mechanism.

Why the Coordinator halt mattered

IOTA’s Coordinator issued signed, zero-value milestones. Under the network design operating in February 2020, transactions referenced by those milestones were treated as confirmed by nodes. The Foundation had described the Coordinator as a protective mechanism while it researched a future coordinator-free design.

That architecture gave the Foundation an emergency brake capable of interrupting value confirmations. It potentially limited additional losses, but it also exposed a central operational dependency in a project presented as distributed-ledger infrastructure. The episode therefore raised two separate questions: whether Trinity’s handling of wallet secrets had been compromised, and whether a network dependent on a Foundation-operated confirmation mechanism could meet users’ expectations of decentralization and continuous availability.

As of February 13, neither the attack vector nor the total loss had been established publicly. Claims that the core protocol was intact were based on the Foundation’s investigation at that stage, while its warning to keep Trinity closed showed that a wallet-level compromise remained a live possibility.

Later-confirmed context

In a February 21 incident report, the Foundation attributed the attack to malicious code delivered through a third-party MoonPay dependency integrated into Trinity. It reported that 50 seeds lost about 8.55 Ti in IOTA tokens. Those findings were not available on February 13 and should not be treated as event-day knowledge. The Foundation’s status history records that the Coordinator resumed normal operation on March 10, 2020.