>Hacker Recycles 1,490 ICON Withdrawal Messages to Trigger Massive Payout Exploit<

According to the ICON Foundation, the August 27 replay attack resulted in the release of approximately 119.9 million ICX and 531.6 billion USD from foundation‑controlled assets, following the reuse of two legitimate withdrawal messages 1,492 times.

An ICON post‑mortem issued on August 30 confirmed that 1,490 calls succeeded despite zero user deposits, balances, or positions being compromised.

The headline‑sized ICX release does not reflect the full financial impact. Net losses to date stand at roughly 150.2 ETH and 31,204 USDC, while the vast majority of the ICX has been traced, frozen, and is undergoing active recovery. The foundation reports that BnUSD and SODA were recovered in principle, yet exchange holdings may still require revision due to missing conversion metrics.

Detection of the ICON replay exploit came before containment

ICON’s monitoring systems fired at 02:08 UTC, seven minutes after the exploitation began. Investigation officially commenced around 03:40, translating to a six‑hour delay before technical staff started working. The affected contract was placed on indefinite pause at 03:53, ninety‑three minutes after the first alert.

During this window the attacker distributed ICX across multiple exchange deposit addresses starting at 02:44, a process that continued until approximately 05:20. A voluntary ICON‑side pause proved insufficient to stop funds already moved into exchange custody.

The network experienced a hard halt at 06:18:54 and saw only partial restoration by approximately 07:51 the next day—about twenty‑five hours later. Major exchanges including Bitvavo, Bitget, and KuCoin reported suspending ICX deposits and withdrawals during the incident, although they refrained from confirming involvement with attacker assets or disclosing exact frozen sums.

Source link