{"investigation":{"slug":"402bridge","entity_name":"402bridge","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"402bridge (also written x402bridge) was a short-lived cross-chain bridge protocol built on the x402 HTTP payment standard, operating at 402bridge.fun. On October 28, 2025, approximately 13 hours after deployment, an attacker exploited a leaked admin private key to drain $17,693 in USDC from 227 user wallets in under 30 minutes; the protocol ceased operations immediately afterward and no user compensation has been announced. Security firm SlowMist noted that while the incident appeared consistent with a private key leak, the possibility of insider involvement could not be ruled out.","sections":[{"content":"402bridge was a cross-chain bridge implementation built on top of the x402 protocol, an open standard that repurposes the HTTP 402 Payment Required status code to enable native, programmatic stablecoin micropayments for AI agents and web services. The x402 protocol itself was developed by Coinbase and subsequently contributed to the Linux Foundation, with Stripe and Cloudflare among its founding-member organizations. 402bridge operated at the domain 402bridge.fun, functioning as a cross-layer asset exchange that locked assets on originating blockchains and minted corresponding mirror assets on target chains, enabling users to move USDC and other tokens across networks. The protocol launched on-chain in late October 2025 and was effectively defunct within days of launch following a catastrophic security incident. The domain 402bridge.fun was registered only two days before the protocol ceased service.","heading":"Protocol Overview","sources":[{"url":"https://superex.medium.com/the-explosion-of-the-x402-protocol-and-the-402bridge-security-incident-an-in-depth-analysis-of-12c909bed5f1","name":"superex.medium.com","type":"other","credibility":3},{"url":"https://crypto.news/402bridge-hack-leads-to-over-200-users-drained-of-usdc/","name":"crypto.news","type":"other","credibility":3},{"url":"https://protos.com/402bridge-private-key-leaks-227-wallets-drained-in-minutes/","name":"protos.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 28, 2025, approximately 13 hours after the protocol's on-chain deployment, the GoPlus Security Chinese community issued an alert flagging abnormal asset transfers from the x402bridge contract. Within minutes, 227 user wallets had been drained of a combined $17,693 in USDC. The entire attack sequence completed in approximately 28 minutes with no user interaction required and no real-time alerts triggered.\n\nThe attacker obtained the admin private key for smart contract 0xed1AFc4DCfb39b9ab9d67f3f7f7d02803cEA9FC5, used it to transfer contract ownership to address 0x2b8F95560b5f1d1a439dd4d150b28FAE2B6B361F, and then invoked the contract's internal transferUserToken function. This function transferred all remaining USDC from wallets that had previously granted unlimited spend authorizations to the bridge contract as part of the minting flow. The stolen USDC was subsequently converted to ETH and bridged to Arbitrum via multiple cross-chain transactions to obscure fund movement.\n\nThe 402bridge team confirmed on social media that the exploit was caused by a private key leak and that more than a dozen team test wallets and main wallets were also compromised in the same incident. The team stated it had reported the matter to law enforcement and would provide community updates, but the protocol's website was taken offline and no recovery or compensation plan has been announced.","heading":"Security Incident — October 28, 2025","sources":[{"url":"https://protos.com/402bridge-private-key-leaks-227-wallets-drained-in-minutes/","name":"protos.com","type":"other","credibility":3},{"url":"https://crypto.news/402bridge-hack-leads-to-over-200-users-drained-of-usdc/","name":"crypto.news","type":"other","credibility":3},{"url":"https://coinstats.app/news/d964dfbe80e937c47aba3ad4414ba4d7cf122e11433fc343e0748f466697e8aa_Over-200-users-lose-USDC-in-x402bridge-hack-as-GoPlus-flags-privatekey-breach/","name":"coinstats.app","type":"other","credibility":3},{"url":"https://www.kucoin.com/news/flash/402bridge-hack-drains-over-200-users-of-17-693-in-usdc","name":"kucoin.com","type":"other","credibility":3},{"url":"https://getfailsafe.com/402bridge-exploit-security-alert/","name":"getfailsafe.com","type":"other","credibility":3},{"url":"https://x.com/402bridge/status/1983042581190853022","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Post-incident analysis by SlowMist and GoPlus Security identified multiple layered security failures that made the attack possible.\n\nThe primary vulnerability was the storage of the administrator private key in plaintext on an internet-connected server. The x402bridge mechanism required the backend server to hold admin credentials to execute contract methods on behalf of users — an architectural decision that concentrated enormous risk in a single server-side secret. If that key was exfiltrated via server compromise or an insider, the attacker gained full administrative control of the smart contract.\n\nCompounding this, the contract itself was designed with an owner-controlled transferUserToken function that permitted the contract owner to transfer USDC directly from any wallet that had previously authorized the contract for spending. Users were required to grant unlimited USDC allowances to the bridge contract as a precondition to minting, creating the attack surface that was ultimately exploited.\n\nSlowMist's post-mortem analysis categorized the structural weaknesses as: single-key admin control with no multi-signature or multi-party computation (MPC); insufficient server isolation; absence of real-time anomaly monitoring; and excessive centralization of control. GoPlus noted in November 2025 that these failure patterns — excessive authorization, honeypot-style owner drain functions, unlimited minting, and signature replay vulnerabilities — were widespread across the broader x402 ecosystem, not unique to 402bridge.\n\nSecurity analyst Yu Xian (SlowMist) stated publicly that internal sabotage could not be ruled out, noting the theft occurred only two days after domain registration. However, Xian also clarified that the evidence did not conclusively point to collective wrongdoing by the project team, distinguishing the incident from a coordinated rug pull.","heading":"Technical Vulnerabilities and Root Cause","sources":[{"url":"https://www.panewslab.com/en/articles/17ffaa3c-2beb-4cd3-b95c-33e26af7567c","name":"panewslab.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560605034172","name":"bitget.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560605034218","name":"bitget.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560605057036","name":"bitget.com","type":"other","credibility":3},{"url":"https://superex.medium.com/the-explosion-of-the-x402-protocol-and-the-402bridge-security-incident-an-in-depth-analysis-of-12c909bed5f1","name":"superex.medium.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/11/17/goplus-security-highlights-key-risks-in-x402-crypto-projects/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Questions were raised by the security community and users as to whether the incident constituted an external hack or an insider attack. Community member 'Ye in Web3' publicly questioned whether the affair was a coordinated rug pull, specifically asking why the contract included a function allowing the owner to drain user funds, and noting the extremely short interval between domain registration and the exploit.\n\nSlowMist's Cosine (Yu Xian) addressed this directly, stating: 'insider involvement cannot be ruled out' while also noting the incident did not appear to be a 'typical case of collective wrongdoing by the project team.' This framing leaves open the possibility that a single insider — rather than the full team — may have been responsible, or that an external attacker specifically targeted the admin key stored on the server.\n\nPeckShield issued a separate advisory urging all users who had interacted with the 402bridge contract to revoke their USDC allowances immediately. FailSafe also published a security alert with remediation steps. No law enforcement outcome has been publicly reported as of the date of this investigation.","heading":"Insider Attack Allegations and Disputed Classification","sources":[{"url":"https://protos.com/402bridge-private-key-leaks-227-wallets-drained-in-minutes/","name":"protos.com","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/17ffaa3c-2beb-4cd3-b95c-33e26af7567c","name":"panewslab.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560605034172","name":"bitget.com","type":"other","credibility":3},{"url":"https://getfailsafe.com/402bridge-exploit-security-alert/","name":"getfailsafe.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The 402bridge incident marked what SlowMist described as 'the first publicly known theft case related to x402 protocol services.' In the weeks that followed, GoPlus Security conducted a systematic audit of more than 30 projects in the x402 ecosystem and found that the majority exhibited at least one high-risk security issue.\n\nHigh-risk projects flagged by GoPlus in November 2025 included FLOCK, x420, U402, MRDN, PENG, x402Token, x402b, x402MO, and H402. The four vulnerability categories most frequently identified were: excessive authorization (owner can drain funds), signature replay (no nonces or expiration times), honeypot behavior (hidden owner-only functions blocking user withdrawals), and unlimited minting.\n\nThe incident exposed a structural contradiction in the x402 ecosystem: while the underlying protocol emphasizes decentralized, autonomous payments for AI agents, many early implementations relied on centralized server-side key management and overpermissioned smart contracts, recreating the custodial trust risks that decentralized infrastructure is meant to eliminate. The x402 Foundation (hosted by the Linux Foundation, with Coinbase, Cloudflare, and Stripe as founding members) is not organizationally affiliated with 402bridge, which was an independent third-party project built on the open protocol standard.","heading":"Broader x402 Ecosystem Risk","sources":[{"url":"https://www.cryptotimes.io/2025/11/17/goplus-security-highlights-key-risks-in-x402-crypto-projects/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://coinpedia.org/news/goplus-issues-urgent-warning-on-x402-tokens-as-exploits-hit-hundreds-of-users/","name":"coinpedia.org","type":"other","credibility":3},{"url":"https://coinfomania.com/x402%E2%80%90ecosystem%E2%80%90goplus%E2%80%90risk/","name":"coinfomania.com","type":"other","credibility":3},{"url":"https://superex.medium.com/the-explosion-of-the-x402-protocol-and-the-402bridge-security-incident-an-in-depth-analysis-of-12c909bed5f1","name":"superex.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the 402bridge team published a statement on social media (X/Twitter account @402bridge) confirming the private key leak and acknowledging that team test wallets and main wallets were also drained. The team stated it had reported the incident to law enforcement and pledged ongoing community updates. The protocol's website at 402bridge.fun was taken offline, and no subsequent community updates, compensation announcements, or recovery plans have been publicly documented as of this writing.\n\nThe team's own wallets being simultaneously compromised could support either the external hack hypothesis (an attacker who obtained the key drained everything in scope) or, alternatively, a staged operation designed to create the appearance of equal victimhood. No independent forensic investigation has been publicly published with a definitive conclusion. Stolen funds traced to Arbitrum did not show further movement after the initial laundering steps, according to reporting at the time of the incident.","heading":"Team Response and Current Status","sources":[{"url":"https://x.com/402bridge/status/1983042581190853022","name":"x.com","type":"other","credibility":3},{"url":"https://www.bitget.com/amp/news/detail/12560605034383","name":"bitget.com","type":"other","credibility":3},{"url":"https://crypto.news/402bridge-hack-leads-to-over-200-users-drained-of-usdc/","name":"crypto.news","type":"other","credibility":3},{"url":"https://forklog.com/en/402bridge-loses-over-17000-usdc/amp/","name":"forklog.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-10-26","event":"402bridge.fun domain registered, approximately two days before the protocol ceased service.","source":""},{"date":"2025-10-28","event":"402bridge protocol deployed on-chain; users began granting USDC allowances to contract 0xed1AFc4DCfb39b9ab9d67f3f7f7d02803cEA9FC5 in preparation for minting.","source":""},{"date":"2025-10-28","event":"Approximately 13 hours after deployment, admin private key compromised. Contract ownership transferred to attacker address 0x2b8F95560b5f1d1a439dd4d150b28FAE2B6B361F.","source":""},{"date":"2025-10-28","event":"Attacker calls transferUserToken function, draining 17,693 USDC from 227 user wallets within 28 minutes. Stolen USDC converted to ETH and bridged to Arbitrum.","source":""},{"date":"2025-10-28","event":"GoPlus Security Chinese community issues first public alert about abnormal asset transfers from x402bridge.","source":""},{"date":"2025-10-28","event":"PeckShield issues advisory urging users to revoke USDC allowances to the compromised contract.","source":""},{"date":"2025-10-28","event":"402bridge team publishes statement on X confirming private key leak, reporting to law enforcement, and acknowledging team wallets were also compromised.","source":""},{"date":"2025-10-28","event":"SlowMist's Yu Xian (Cosine) states the attack was caused by private key leakage and notes insider involvement cannot be ruled out; characterizes this as the first publicly known theft linked to x402 protocol services.","source":""},{"date":"2025-10-28","event":"402bridge.fun website taken offline. Protocol ceases operations.","source":""},{"date":"2025-11-17","event":"GoPlus Security publishes audit findings covering 30+ x402 ecosystem projects, finding the majority had at least one high-risk vulnerability; references 402bridge as the catalyst for the broader ecosystem security review.","source":""}],"sources_used":[{"url":"https://superex.medium.com/the-explosion-of-the-x402-protocol-and-the-402bridge-security-incident-an-in-depth-analysis-of-12c909bed5f1","name":"superex.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/402bridge-hack-leads-to-over-200-users-drained-of-usdc/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251114061231/https://crypto.news/402bridge-hack-leads-to-over-200-users-drained-of-usdc/","credibility":3,"archive_timestamp":"2025-11-14T06:12:31+00:00"},{"url":"https://protos.com/402bridge-private-key-leaks-227-wallets-drained-in-minutes/","name":"protos.com","type":"other","archive_url":"http://web.archive.org/web/20260606021320/https://protos.com/402bridge-private-key-leaks-227-wallets-drained-in-minutes/","credibility":3,"archive_timestamp":"2026-06-06T02:13:20+00:00"},{"url":"https://coinstats.app/news/d964dfbe80e937c47aba3ad4414ba4d7cf122e11433fc343e0748f466697e8aa_Over-200-users-lose-USDC-in-x402bridge-hack-as-GoPlus-flags-privatekey-breach/","name":"coinstats.app","type":"other","archive_url":"http://web.archive.org/web/20260829113304/https://coinstats.app/news/d964dfbe80e937c47aba3ad4414ba4d7cf122e11433fc343e0748f466697e8aa_Over-200-users-lose-USDC-in-x402bridge-hack-as-GoPlus-flags-privatekey-breach/","credibility":3,"archive_timestamp":"2026-08-29T11:33:04+00:00"},{"url":"https://www.kucoin.com/news/flash/402bridge-hack-drains-over-200-users-of-17-693-in-usdc","name":"kucoin.com","type":"other","archive_url":"https://web.archive.org/web/20260829050428/https://www.kucoin.com/news/flash/402bridge-hack-drains-over-200-users-of-17-693-in-usdc","credibility":3,"archive_timestamp":"2026-08-29T05:04:28+00:00"},{"url":"https://getfailsafe.com/402bridge-exploit-security-alert/","name":"getfailsafe.com","type":"other","archive_url":"http://web.archive.org/web/20260212001031/https://getfailsafe.com/402bridge-exploit-security-alert","credibility":3,"archive_timestamp":"2026-02-12T00:10:31+00:00"},{"url":"https://x.com/402bridge/status/1983042581190853022","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.panewslab.com/en/articles/17ffaa3c-2beb-4cd3-b95c-33e26af7567c","name":"panewslab.com","type":"other","archive_url":"http://web.archive.org/web/20251101061146/https://www.panewslab.com/en/articles/17ffaa3c-2beb-4cd3-b95c-33e26af7567c","credibility":3,"archive_timestamp":"2025-11-01T06:11:46+00:00"},{"url":"https://www.bitget.com/news/detail/12560605034172","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260829044305/https://www.bitget.com/news/detail/12560605034172","credibility":3,"archive_timestamp":"2026-08-29T04:43:05+00:00"},{"url":"https://www.bitget.com/news/detail/12560605034218","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260829044309/https://www.bitget.com/news/detail/12560605034218","credibility":3,"archive_timestamp":"2026-08-29T04:43:09+00:00"},{"url":"https://www.bitget.com/news/detail/12560605057036","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260829083442/https://www.bitget.com/news/detail/12560605057036","credibility":3,"archive_timestamp":"2026-08-29T08:34:42+00:00"},{"url":"https://www.cryptotimes.io/2025/11/17/goplus-security-highlights-key-risks-in-x402-crypto-projects/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20251118110116/https://www.cryptotimes.io/2025/11/17/goplus-security-highlights-key-risks-in-x402-crypto-projects/","credibility":3,"archive_timestamp":"2025-11-18T11:01:16+00:00"},{"url":"https://coinpedia.org/news/goplus-issues-urgent-warning-on-x402-tokens-as-exploits-hit-hundreds-of-users/","name":"coinpedia.org","type":"other","archive_url":"http://web.archive.org/web/20251118030459/https://coinpedia.org/news/goplus-issues-urgent-warning-on-x402-tokens-as-exploits-hit-hundreds-of-users/","credibility":3,"archive_timestamp":"2025-11-18T03:04:59+00:00"},{"url":"https://coinfomania.com/x402%E2%80%90ecosystem%E2%80%90goplus%E2%80%90risk/","name":"coinfomania.com","type":"other","archive_url":"http://web.archive.org/web/20260123165403/https://coinfomania.com/x402%E2%80%90ecosystem%E2%80%90goplus%E2%80%90risk/","credibility":3,"archive_timestamp":"2026-01-23T16:54:03+00:00"},{"url":"https://www.bitget.com/amp/news/detail/12560605034383","name":"bitget.com","type":"other","archive_url":"http://web.archive.org/web/20260829043926/https://www.bitget.com/amp/news/detail/12560605034383","credibility":3,"archive_timestamp":"2026-08-29T04:39:26+00:00"},{"url":"https://forklog.com/en/402bridge-loses-over-17000-usdc/amp/","name":"forklog.com","type":"other","archive_url":"https://web.archive.org/web/20260829115026/https://forklog.com/en/402bridge-loses-over-17000-usdc/","credibility":3,"archive_timestamp":"2026-08-29T11:50:26+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:20.678452+00:00","updated_at":"2026-08-29T18:16:46.300093+00:00"}}