An unusually large outflow of funds from a multi-chain MPC bridge platform has raised concerns about a multi-million dollar breach.
On July 6, observers noticed that around $102 million worth of cryptocurrencies had been withdrawn from the Ethereum side of Multichain's Fantom bridge, along with $666,000 from Dogechain and $5 million from Moonriver. 7,214 Wrapped Ether (WETH) tokens worth $ 13.6 million, 1,024 Wrapped Bitcoins (WBTC) worth $31 million, and USD tokens worth $58 million on July 6 Withdrawals from Fantom Bridge's Ethereum smart contracts — a total of approximately $102 million in cryptocurrency.
Additionally, the Dogechain bridge's Ethereum contract withdraw $666,000, or more than 86% of the total deposits, leaving only about $100,000 worth of assets in the bridge. USDC and Tether worth a combined $5,872,661, Withdrawn from the multi- chain Moonriver bridge contract on Ethereum , only about $700,000 is left.
Several on-chain sleuths flagged the incident as a possible exploit on Twitter. Blockchain security firm PeckShield tagged the Multichain team in a post showing the Fantom bridge transaction, saying: “You might want to take a look.” This led one commenter to comment that this looks like "another massive hack". On-chain investigator Spreek posted the Dogechain transaction and commented that "Dogechain multi-chain exhaustion".
At press time, Cointelegraph was unable to confirm whether these contracts were “drained,” or if the large amounts of funds were simply withdrawn by users. In a later tweet, Multichain told its Twitter followers that the actions were not normal and that the team was "unsure what happened and is currently investigating." Multichain is a multi-party computation (MPC) bridge network. When a user wants to bridge an asset from one chain to another, the multi-chain network first confirms that the asset is locked on the first chain, and then mints the derivative asset on the second chain.
When withdrawals are made, the network performs the reverse process: it first confirms that the derivative coins on the second chain have been destroyed, and then releases the assets backing them on the first chain.
The multichain team claims that the encryption keys that control this process are split into multiple shards and distributed across the network. In theory, this should prevent unauthorized withdrawals by any individual or group.
Multichain has been suffering from unspecified technical issues for the past few weeks. On May 31, the team announced that its CEO was missing and that "multiple issues arose due to unforeseen circumstances" that had delayed the deal. On July 5, Binance susp ended the Withdrawal of some multi-chain derivative tokens due to the network's failure to process transactions in a timely manner.
