The Multichain Catastrophe: How Compromised Admin Keys Drained $130 Million From Cross-Chain Bridges

On July 5, 2023, the cryptocurrency ecosystem witnessed one of the most alarming security incidents of the year when Multichain, a prominent cross-chain router protocol, was drained of approximately $130 million in digital assets. The exploit targeted multiple bridge endpoints across Fantom, Moonriver, and Dogechain networks, sending shockwaves through a decentralized finance community still reeling from a string of high-profile breaches. Bitcoin traded at roughly $30,514 while Ethereum hovered near $1,911 at the time, masking the severity of the underlying infrastructure failure that was unfolding on-chain.

The Exploit Mechanics

The attack on Multichain did not involve a sophisticated smart contract vulnerability or a flash loan exploit. Instead, blockchain security researchers concluded that the perpetrator gained control of the protocol’s Multi-Party Computation (MPC) node server keys. These administrative keys serve as the master access point for authorizing cross-chain asset transfers, and once compromised, they granted unrestricted authority to move funds across every connected bridge. Security analysts at Chainalysis characterized the incident as a likely insider operation, noting that the compromise of keys at this level typically requires either direct access to the operational infrastructure or cooperation from someone who holds it. The attacker methodically moved assets out of bridge pools on Fantom, Moonriver, and Dogechain, draining wrapped tokens, stablecoins, and native assets worth an estimated $126 million to $130 million before the community could respond.

Affected Systems

The Fantom network bore the brunt of the damage, with significant quantities of USDC, DAI, and wrapped Bitcoin siphoned from its Multichain bridge pool. Moonriver, a Kusama-based parachain, and Dogechain also reported substantial outflows. The attack compounded an already deteriorating situation at Multichain. Since late May 2023, users had been reporting abnormal delays in cross-chain transfers. On May 24, the team had attributed these delays to an undisclosed force majeure event, which the community later learned was connected to the disappearance of CEO Zhaojun. On May 21, Chinese authorities had arrested Zhaojun at his home, and shortly afterward, the Multichain team discovered that their operational access keys to the MPC node servers had been revoked. Without access to the servers that facilitate cross-chain operations, the team could not process pending transactions, leading to the cascading delays users experienced throughout June.

The Mitigation Strategy

In the immediate aftermath, Multichain urged all users to cease using the platform and revoke contract approvals. Circle and Tether, the issuers of USDC and USDT respectively, took swift action by freezing approximately $62.5 million worth of stolen stablecoins, preventing the attacker from liquidating a significant portion of the loot. The BlockSec analytics team also identified that the exploiter burned 1.2 million ICE tokens, worth roughly $1.8 million, from a specific address labeled 0x9d57, suggesting an element of the attack that remains poorly understood. Five days later, on July 10, an additional $107 million was drained from the protocol, bringing total losses to approximately $231 million. The subsequent investigation revealed that Zhaojun’s family had granted access to his home computer, which contained historical server credentials, and this access was used to facilitate the second wave of thefts.

Lessons Learned

The Multichain incident highlights a fundamental weakness in the cross-chain bridge model: centralized key management. Despite operating in a decentralized ecosystem, many bridge protocols rely on small sets of administrative keys held by a handful of individuals. When those keys are compromised, whether through arrest, coercion, or insider collusion, the entire bridge becomes vulnerable. The lesson for the industry is clear: bridge protocols must implement distributed key management with time-locked transactions, multi-signature requirements spanning multiple jurisdictions, and transparent governance structures that prevent any single point of failure from becoming a catastrophic one.

User Action Required

For users who held assets on Multichain-bridged chains, the priority is to verify whether any funds remain accessible. Revoking outstanding token approvals on the Multichain router contracts is essential to prevent future unauthorized transfers. Users should migrate to bridge alternatives that employ verifiable multi-signature schemes and have undergone comprehensive third-party security audits. The broader community should monitor on-chain forensic reports from firms like Chainalysis and TRM Labs, which continue to trace the movement of stolen funds across decentralized exchanges and mixing services. As the industry matures, the Multichain hack stands as a stark reminder that decentralization at the application layer means nothing if the keys controlling the infrastructure remain dangerously centralized.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.