402bridge
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 41. Problems weighed by who is responsible: the subject's own conduct −16, incidents the subject suffered −3.2, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -16 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -3.2 |
| Problems around it, caused by others | -1.6 |
| Sum | 41 |
Score: 41/100 (kept between 0 and 100)
How scoring works →Summary
402bridge (also written x402bridge) was a short-lived cross-chain bridge protocol built on the x402 HTTP payment standard, operating at 402bridge.fun. On October 28, 2025, approximately 13 hours after deployment, an attacker exploited a leaked admin private key to drain $17,693 in USDC from 227 user wallets in under 30 minutes; the protocol ceased operations immediately afterward and no user compensation has been announced. Security firm SlowMist noted that while the incident appeared consistent with a private key leak, the possibility of insider involvement could not be ruled out.
Connected Entities
3 entities · 60 linked investigations- 402bridge→mentioned with→Coinbase(65%)
- 402bridge→mentioned with→Arbitrum(70%)
- Arbitrum→mentioned with→Coinbase(65%)
Connected Through
2 shared actors · 409 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Coinbasetoken
- □Arbitrumorganization
Timeline(10 events)
26 October 2025
402bridge.fun domain registered, approximately two days before the protocol ceased service.
28 October 2025
402bridge protocol deployed on-chain; users began granting USDC allowances to contract 0xed1AFc4DCfb39b9ab9d67f3f7f7d02803cEA9FC5 in preparation for minting.
28 October 2025
Approximately 13 hours after deployment, admin private key compromised. Contract ownership transferred to attacker address 0x2b8F95560b5f1d1a439dd4d150b28FAE2B6B361F.
28 October 2025
Attacker calls transferUserToken function, draining 17,693 USDC from 227 user wallets within 28 minutes. Stolen USDC converted to ETH and bridged to Arbitrum.
28 October 2025
GoPlus Security Chinese community issues first public alert about abnormal asset transfers from x402bridge.
28 October 2025
PeckShield issues advisory urging users to revoke USDC allowances to the compromised contract.
28 October 2025
402bridge team publishes statement on X confirming private key leak, reporting to law enforcement, and acknowledging team wallets were also compromised.
28 October 2025
SlowMist's Yu Xian (Cosine) states the attack was caused by private key leakage and notes insider involvement cannot be ruled out; characterizes this as the first publicly known theft linked to x402 protocol services.
28 October 2025
402bridge.fun website taken offline. Protocol ceases operations.
17 November 2025
GoPlus Security publishes audit findings covering 30+ x402 ecosystem projects, finding the majority had at least one high-risk vulnerability; references 402bridge as the catalyst for the broader ecosystem security review.
Decision Log
- slot 455359556 · hash GAyAdT3HzGhTDza9SfqkPjGG75ThQZgk3VMPytR3DCzP
- slot 422981707 · hash 524scmXY5ztVYpKgYjkmMGtMf5trVHnC4mUzFzUDymiH
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 14 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:20 AM
last updated: 10/10/2026, 6:40:51 PM
8 viewsavoid.net — verified advice for a post-truth world