On June 2, 2025, the Nervos Network suffered a devastating blow to its cross-chain infrastructure when ForceBridge, the protocol’s primary asset bridge connecting Nervos to Ethereum and BNB Chain, was exploited for approximately $3.9 million in stolen funds. The attack, first detected by blockchain security firm Cyvers Alerts, exposed fundamental weaknesses in access control mechanisms that continue to plague the Web3 ecosystem at a time when Bitcoin trades above $105,000 and institutional interest in crypto reaches new heights.
The Exploit Mechanics
The attack unfolded over several hours, beginning with reconnaissance attempts shortly after 01:30 UTC on June 2. According to security firm Hacken, the attacker made multiple failed attempts to breach ForceBridge on BNB Chain over a six-hour window before successfully executing the exploit.
A small test transaction at approximately 02:23 UTC netted the attacker just $25, serving as a proof-of-concept before the full-scale assault. The main attack occurred at 07:36 UTC, when 874 BNB — worth roughly $572,000 at the time — was drained from the bridge. Additional funds were subsequently siphoned from both BNB Chain and Ethereum sides.
The total losses included 539 Ethereum (ETH), approximately 898,300 USD Coin (USDC), 257,800 Tether (USDT), 60,400 Dai (DAI), and 0.79 Wrapped Bitcoin (WBTC). The stolen assets were quickly funneled through cryptocurrency mixers and anonymous platforms, including Tornado Cash and FixedFloat, in an attempt to obscure the trail.
The root cause was identified as a critical access control vulnerability. The attacker gained access to privileged functions within the protocol’s smart contracts, allowing them to bypass security controls and drain locked assets from both sides of the bridge.
Affected Systems
ForceBridge plays a central role in Nervos Network’s multi-chain architecture, enabling transfers of assets including ETH, ERC-20 tokens, and other digital assets between Nervos (CKB) and external networks such as Ethereum and Binance Smart Chain. The bridge operates by locking assets on the source chain and issuing corresponding tokens on Nervos, secured by a multi-signature wallet system.
The breach affected both the Ethereum and BNB Chain sides of the bridge. Approximately $3 million was drained from the Ethereum side, with an additional $800,000 taken from BNB Chain. Magickbase, a Nervos community developer, responded by immediately halting all ForceBridge activity, stating: “We’ve detected abnormal activity on ForceBridge and have paused the service as a precaution. Our team is investigating.”
This incident compounds a challenging period for the cryptocurrency industry, which lost $244.1 million to hacks in May 2025 alone, according to blockchain security firm PeckShield.
The Mitigation Strategy
Following the breach, the Nervos team implemented an emergency protocol that included the complete shutdown of ForceBridge operations, freezing all pending transactions and preventing further asset movement. The team initiated a comprehensive forensic investigation to determine the full scope of the vulnerability and identify any additional attack vectors.
Security researchers from Hacken emphasized that the attack could have been prevented with proper real-time monitoring systems. The firm noted that the attacker’s repeated failed attempts over a six-hour window should have triggered immediate alerts, giving defenders time to respond before the full exploit was executed.
The incident highlights the growing importance of proactive threat detection in cross-chain protocols, where the attack surface extends across multiple blockchain networks simultaneously.
Lessons Learned
The ForceBridge exploit reinforces several critical security principles that the Web3 industry continues to learn the hard way. First, access control remains one of the most critical and frequently exploited vulnerability categories in decentralized systems. The De.Fi REKT report for June 2025 documented that access control weaknesses accounted for over $87 million in losses across four incidents, making it the dominant attack vector for the month.
Second, the six-hour window between initial reconnaissance and the final exploit underscores the need for real-time on-chain monitoring tools that can detect anomalous behavior before it escalates. Bridges, which handle large pools of locked assets across multiple chains, represent particularly high-value targets that demand the highest security standards.
Third, the speed at which stolen funds were laundered through mixers and anonymous platforms demonstrates the difficulty of post-incident recovery. In June 2025, zero funds were recovered from the $114.8 million lost across 11 separate exploits.
User Action Required
Users who interacted with ForceBridge should immediately check their transaction history and verify the status of any pending cross-chain transfers. Nervos community developers have advised all users to avoid interacting with ForceBridge until the investigation is complete and a patched version of the bridge is deployed. Developers building on Nervos should review their own integration code to ensure they are not relying on ForceBridge for critical operations, and should consider implementing fallback mechanisms for cross-chain asset transfers.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making investment decisions.
Real-time monitoring tools are getting better at catching exploits early
monitoring caught it at 01:30 UTC but the actual drain happened at 07:36. six hour window between detection and response. bridge teams need automated pause mechanisms
6 hours between detection and drain. every bridge launched after wormhole should have an automated kill switch. no excuses at this point
rekt_detector six hours between detection and drain with no automated pause. after everything that happened in 2022 with bridges this is inexcusable
3.9M from a bridge in 2025. the access control bug was basically a multisig with too few signers and no timelock. we keep solving the same problem badly
The industry needs standardized security audit frameworks
Social engineering attacks are becoming more sophisticated
social engineering to get access to a bridge multisig is the same playbook as the ronin and wormhole attacks. bridge security IS key management security
874 BNB in the main attack after a $25 test transaction. they spent 6 hours probing before going for the full drain. professional operation with serious opsec
$25 test tx is standard recon. any bridge monitor that doesnt flag sub hundred dollar txs from fresh addresses is missing basic threat detection
Kenji M. the $25 test tx is a classic attacker fingerprint. bridge monitors should auto-flag any transaction under $100 from new addresses as a recon probe