What happened
An attacker replayed two previously valid signed withdrawal messages 1,492 times during a roughly twenty-minute window. 1,490 calls succeeded, releasing 119,866,000 ICX and 531,600 bnUSD into an attacker-controlled relayer wallet.
ICON says all affected assets were foundation-held and no user deposits, balances or positions were accessed.
Root cause
A serialization / integer-precision defect meant replay protection and signature verification effectively operated on different portions of the message serial number.
The attacker could alter unsigned high bits so the uniqueness check saw a “new” request, while signature verification continued accepting the original authorization.
Gross flow vs. net loss
Most exploited ICX moved to centralized exchanges and was subsequently frozen or placed under preservation requests.
ICON’s current confirmed net loss is approximately 150.2 ETH + 31,204 USDC. The 531,600 bnUSD exposure and 1,366,000 SODA were recovered in full, and 82,430 of 113,634 borrowed USDC was recovered.
Detection and containment
Monitoring alerted within minutes, but technical investigation, contract pause and network-wide halt occurred later. ICON’s own post-mortem identifies an operational gap between detection and fast containment.
The network resumed August 28 after the root-cause fix was deployed.
Fixes
ICON corrected serialization, added an authorized-relayer allowlist, created regression tests reproducing the exploit, reviewed equivalent code on other chains and is moving toward faster automatic shutdown behavior.
Evidence Status
The core root cause, timeline and financial accounting are Confirmed by the ICON Foundation post-mortem. Exact final recovery numbers may still change as exchanges and law enforcement complete their work.
Risk Assessment
High. The technical exploit was severe and forced a network halt, but user balances were not directly compromised and much of the gross value remains frozen/recoverable.
What to Watch Next
Exchange-frozen ICX recovery; final net loss; attacker identification; audit follow-up; automatic containment improvements.
FAQ
Was 119.9M ICX permanently lost?
No. That was gross released value; ICON says most was frozen at exchanges.
What is the confirmed net loss?
About 150.2 ETH plus 31,204 USDC.
Were users affected?
ICON says user deposits, balances and positions were not accessed.
Is the network back online?
Yes.