Hack history / 2026 / Hack or exploit
IoTeX’s ioTube bridge
Hack or exploit on Feb 21, 2026 · Validator Key Compromised
IN REVIEWSOURCES DISAGREE ON DATE OR LOSS · 4 SOURCES
Lost
$4.4M
sources: $2M to $4.4M
Returned
none listed
as the sources state it
Rank
#489
among thefts by dollars lost
What happened
On February 21, 2026, ioTube bridge's Ethereum-side Validator contract private key was compromised via social engineering targeting an employee. The attacker performed a malicious upgrade bypassing validation and signature checks, gaining control of TokenSafe and MintPool. Approximately $4.3M in USDC, USDT, IOTX, WBTC, and BUSD were drained within hours. Attackers were credited to the same group behind the Infini exploit.
In review: sources disagree on the loss.
Details
- Date
- Feb 21, 2026
- Kind
- Hack or exploit
- Method
- Validator Key Compromised
- How in
- Keys, accounts and infrastructure
- Target
- DeFi protocol
- Chains
- Ethereum
After the theft
- Returned by the attacker
- yes, amount not stated
“$440,000) and be exempted from legal liability if the funds are returned within 48 hours.” (SlowMist Hacked)
Related incidents
Cite this page
SwanBluechip, "IoTeX’s ioTube bridge hack, Feb 21, 2026: $4.4M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht61531e2675/ (data as of 2026-11-01).