Multichain reported abnormal bridge transfers exceeding $125 million

Multichain reported on July 6, 2023 that assets locked in its cross-chain bridge had moved “abnormally” to an unknown address, after blockchain observers identified transfers involving more than $125 million of tokens. The protocol said it did not know what had happened, was investigating and recommended that users suspend use of its services and revoke contract approvals.

The development mattered because Multichain was not simply another token issuer. It provided infrastructure for moving representations of assets among otherwise separate blockchains. Tokens circulating on a destination network depended on assets retained elsewhere by the bridge. When those reserves moved without an accompanying, ordinary bridge operation, users faced uncertainty about whether their destination-chain tokens remained fully backed.

What moved on July 6

Ethereum records show a series of transfers from an address identified by Etherscan as the Multichain Fantom Bridge. One transaction, confirmed at 18:10:35 UTC on July 6, transferred exactly 27,653,471 USDC to an address the explorer subsequently labeled suspicious. The transaction was successful and recorded in Ethereum block 17,636,491.

That transaction establishes one portion of the movement without relying on a dollar-price conversion: 27,653,471 units of USDC left the bridge address. Etherscan’s address names are explorer metadata, not information embedded by Ethereum consensus, so the attribution also depends on the explorer’s labeling and corroborating reports.

Contemporaneous reporting identified approximately $58 million in USDC, 1,020 wrapped bitcoin valued near $30.9 million, 7,200 wrapped ether valued near $13.7 million and roughly $4 million in DAI moving from the Fantom bridge. Additional tokens included LINK, CRV, YFI, WOO and UNIDX. Separate movements were reported from bridge wallets associated with Moonriver and Dogechain.

Those dollar figures were estimates made on July 6 from observed token quantities and then-current market values. They were not audited losses, realized sale proceeds or proof that every asset could be redeemed at the quoted value. A contemporaneous Unchained calculation placed the receiving addresses’ holdings above $126 million. Chainalysis, publishing its forensic assessment on July 10, calculated more than $125 million in unauthorized withdrawals, including nearly $120 million associated with the Fantom bridge, $6.8 million from the Moonriver bridge and approximately $666,000 from the Dogecoin bridge.

An unresolved control failure

The movement pattern immediately raised the possibility that whoever initiated the transactions had access to bridge-controlled signing authority. Multichain described its system as using multi-party computation, in which authorization should depend on distributed key material rather than one ordinary private key. On July 6, however, the public record did not establish whether an outside attacker, an insider or another authorized party controlled the destination addresses.

Descriptions such as “hack,” “exploit” and “rug pull” therefore remained hypotheses during the event-day window. Verified facts were narrower: assets moved from identified bridge addresses; Multichain characterized the movements as abnormal; the protocol said the destination was unknown; and users were advised to stop interacting with the service.

The incident also illustrated a structural distinction between native and bridged assets. Native FTM on Fantom, for example, was not the same instrument as a token whose value depended on reserves maintained by Multichain. The immediate risk centered on bridge-issued or bridge-backed representations and the reserves supporting them, not on the continued operation of every affected blockchain.

Later context

On July 7, Multichain said its service had stopped and warned that bridge transactions would remain stuck on their source chains. On July 14, the team disclosed that chief executive Zhaojun had been detained by Chinese police on May 21 and that access to critical systems had been lost, then announced that operations would cease.

Those later statements clarified the protocol’s severe governance and key-management problems. They were not public confirmation on July 6 of who initiated the transfers, and they do not by themselves prove whether the first movements were external theft or an internal action.