Multichain 🌉 Bridge

On July 6–7, 2023, the cross-chain bridge protocol Multichain lost roughly $126 million in assets, most of it drained through its Fantom bridge and moved to addresses with no prior connection to the protocol. The stolen tokens included around $58 million in USDC, $31 million in WBTC, $13.6 million in wETH, plus DAI and LINK. Multichain told users to revoke all approvals and halted its bridges; security firm CertiK, brought in afterward, attributed the loss to a compromise of the private keys used to authorize bridge transfers rather than to a smart-contract bug (CoinCodeCap).

How the attack worked

Multichain didn't rely on a classic single-key wallet to move funds between chains — transfers were authorized through a multi-party computation (MPC) setup, where several key shares held on separate nodes jointly sign a withdrawal so that, in theory, no single party can move funds alone. In practice, the nodes ran on cloud infrastructure tied to one person: Multichain's CEO, known by the alias Zhaojun. He had been detained by Chinese police on May 21, 2023 — about six weeks before the exploit — and his devices, including material needed to reach the MPC servers, were confiscated (Bitcoinist). Whoever withdrew the funds on July 6–7 had working access to those keys or nodes; the "unknown method" label reflects that nobody has publicly established whether that access came from an external theft, an insider using the keys before losing control of them, or someone who still had access acting under pressure. A Chainalysis review pointed to circumstantial signs of inside knowledge: the withdrawals initially avoided some centrally-controlled stablecoins that issuers can freeze, behavior more typical of someone who understood which assets were traceable (NewsBTC). No prior audit of Multichain's contracts had reason to catch this: the failure sat in who controlled the signing keys, not in the code the auditors reviewed (Halborn).

What happened after

Multichain confirmed the CEO's arrest publicly only on July 14, 2023, after weeks of speculation, and said the team no longer had access to operational funds or servers. His family eventually regained partial access to the MPC cloud account using information from his home computer, but too late to prevent or reverse the drain. Circle and Tether blacklisted several addresses holding stolen funds, freezing about $67.5 million — roughly half the total — in USDC and USDT (Frontal.io). Freezing is not the same as returning: none of that money has gone back to Multichain or to the users whose bridged assets were drained. Binance and other exchanges suspended deposits and withdrawals for bridged Multichain tokens. The team announced it was ceasing operations indefinitely, and the protocol has not resumed since.

What this means

• MPC and multisig bridges shift the trust question from "is the contract code correct" to "who controls the signing infrastructure" — a contract audit doesn't cover that second question, and this loss happened despite Multichain having been audited.
• When key infrastructure runs on one person's personal cloud account, the protocol's solvency becomes hostage to that person's legal and physical situation, not just their honesty.
• A founder or core team going dark for weeks before an exploit is a visible warning sign users can act on ahead of time — Multichain's CEO had been unreachable for over a month before the drain.
• Stablecoin-issuer freezes make for reassuring headlines but have not historically resulted in funds reaching depositors — read "frozen" as contained, not recovered.