{"investigation":{"slug":"forcebridge","entity_name":"ForceBridge","trust_score":20,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"ForceBridge is a cross-chain bridge operated by Magickbase on the Nervos Network (CKB), enabling transfers between Nervos and Ethereum and BNB Chain. On June 2, 2025, the bridge was exploited via an access control vulnerability — likely a compromised private key — resulting in approximately $3.7–3.9 million in user funds being stolen and laundered through Tornado Cash. The exploit occurred just one day after Magickbase announced the bridge's sunset, raising questions about the timing and origin of the attack.","sections":[{"content":"ForceBridge is an open-source cross-chain bridge that connects the Nervos Network (CKB) to external blockchains, primarily Ethereum and Binance Smart Chain (BSC). It was developed and maintained by Magickbase, a major Nervos community developer. The bridge enables users to lock ERC-20 or BEP-20 assets on the source chain and receive equivalent wrapped tokens on CKB via a multi-signature custody mechanism. The project launched on Nervos mainnet in October 2021. Supported assets included ETH, DAI, USDC, USDT, and WBTC. On May 31, 2025, Magickbase announced it would be sunsetting ForceBridge due to low user activity and high maintenance costs, with a withdrawal window running through January 16, 2026.","heading":"Overview","sources":[{"url":"https://www.cryptoninjas.net/2021/10/14/nervos-force-bridge-now-live-to-allow-cross-chain-connection-to-ethereum-cardano-polkadot/","name":"cryptoninjas.net","type":"other","credibility":3},{"url":"https://forkast.news/headlines/nervos-launches-cross-chain-force-bridge/","name":"forkast.news","type":"other","credibility":3},{"url":"https://sunset.forcebridge.com/announcement","name":"sunset.forcebridge.com","type":"other","credibility":3},{"url":"https://medium.com/nervosnetwork/nervos-launches-force-bridge-to-connect-ethereum-dapps-users-with-ckb-24450df468f4","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 2, 2025, ForceBridge suffered a critical security breach. Blockchain security firm Cyvers Alerts was first to detect suspicious activity, reporting that a suspicious address had gained control of the bridge and was draining assets across Ethereum and BNB Chain. The attacker exploited an access control vulnerability — according to multiple security analysts, this was achieved by accessing privileged functions within the protocol's smart contracts, most likely through compromised private keys rather than a smart contract logic flaw. The attacker made several failed attempts over a six-hour period before succeeding, with a small test drain of approximately $25 at 02:23 UTC and the full-scale exploit executing at 07:36 UTC. Total estimated losses ranged from approximately $3.7 million to $3.9 million across both chains: roughly $3.1 million on Ethereum and $600,000–$800,000 on BNB Chain. Assets stolen included 539.09 ETH, 898,300 USDC, 257,800 USDT, 60,400 DAI, and 0.79 WBTC. Stolen funds were swapped to ETH and laundered through Tornado Cash and FixedFloat across multiple newly created wallets.","heading":"June 2025 Exploit","sources":[{"url":"https://mpost.io/cyvers-alerts-detects-3m-exploit-on-nervos-network-bridge-magickbase-suspends-contracts-amid-investigation/","name":"mpost.io","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://crypto.news/nervos-network-suffers-major-exploit-as-3-9m-in-crypto-is-stolen-from-force-bridge/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://cryptonewsland.com/nervos-networks-force-bridge-breached-crypto-losses-reach-3-9-million/","name":"cryptonewsland.com","type":"other","credibility":3},{"url":"https://de.fi/blog/de-fi-rekt-report-june-2025-114-8-million-lost-across-11-exploits","name":"de.fi","type":"other","credibility":3}],"severity":"medium"},{"content":"Security analysts noted that the exploit occurred just one day after Magickbase publicly announced the bridge's six-month wind-down on May 31, 2025. The attacker's funding wallet was activated shortly after the sunset announcement. Halborn's post-exploit analysis observed that the timing suggests either an insider threat or someone who had previously obtained privileged credentials and waited for an optimal moment to act, noting that available bridge funds would only decrease as the wind-down proceeded. No specific attacker identity or wallet address has been publicly confirmed in available reporting. Funds were dispersed through multiple newly created wallets and routed through Tornado Cash and FixedFloat, complicating on-chain attribution. No public on-chain attribution report from ZachXBT, Cyvers, or other investigators linking the exploit to a known threat actor has been identified in available sources.","heading":"Suspicious Timing and Attribution","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://beincrypto.com/crypto-hacks-nervos-force-bridge-bitopro-exchange/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following detection of abnormal activity, Magickbase paused all ForceBridge smart contracts and issued a public statement via X: 'We've detected abnormal activity on #ForceBridge and have paused the service as a precaution. Our team is investigating.' The organization subsequently disclosed that approximately $3.7 million in user funds were affected and stated it was actively cooperating with local law enforcement agencies and partner exchanges to investigate the incident. No public recovery of stolen funds or user compensation plan has been announced in available sources. The official sunset hub at sunset.forcebridge.com was updated to reflect the bridge's extended wind-down deadlines — Force Bridge closure moved to January 16, 2026.","heading":"Team Response and Law Enforcement","sources":[{"url":"https://www.okx.com/en-us/news/article/magickbase-3-7-million-funds-affected-due-hack-45867251099680","name":"okx.com","type":"other","credibility":3},{"url":"https://mpost.io/cyvers-alerts-detects-3m-exploit-on-nervos-network-bridge-magickbase-suspends-contracts-amid-investigation/","name":"mpost.io","type":"other","credibility":3},{"url":"https://sunset.forcebridge.com/announcement","name":"sunset.forcebridge.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/89e3b-threat-actors-take-over-nervos-network","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Magickbase announced on May 31, 2025 that ForceBridge and the associated Godwoken EVM-compatible layer would be shut down as part of a strategic pivot toward UTXO-native protocols including RGB++. Stated reasons included low user activity and high long-term maintenance costs. The official withdrawal window for Force Bridge was set from June 1 to November 30, 2025, subsequently extended to January 16, 2026. Assets remaining in the bridge after the deadline would be held in custody by Magickbase and potentially subject to custodial retrieval fees. Following the June 2025 exploit, the bridge's ETH and BSC contracts were disabled indefinitely pending investigation. The protocol is no longer active for new bridging operations.","heading":"Protocol Sunset and Current Status","sources":[{"url":"https://sunset.forcebridge.com/announcement","name":"sunset.forcebridge.com","type":"other","credibility":3},{"url":"https://sunset.forcebridge.com/","name":"sunset.forcebridge.com","type":"other","credibility":3},{"url":"https://forkast.news/headlines/nervos-launches-cross-chain-force-bridge/","name":"forkast.news","type":"other","credibility":3}],"severity":"medium"},{"content":"ForceBridge relied on a multi-signature wallet mechanism on Ethereum to hold locked assets. The June 2025 exploit exposed a fundamental risk in the design: privileged administrative functions within the bridge contracts could be invoked by any party in possession of the requisite private keys or access credentials, without additional on-chain safeguards. The access control failure allowed the attacker to unlock and withdraw user funds without completing the corresponding cross-chain redemption process. Security researchers at Halborn noted the root cause was likely compromised credentials rather than a smart contract code bug. The use of custodial multi-sig architecture, combined with what appear to have been inadequate key management practices during the wind-down phase, represents a systemic operational security failure.","heading":"Security Architecture and Risk Factors","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://cryptonewsland.com/nervos-networks-force-bridge-breached-crypto-losses-reach-3-9-million/","name":"cryptonewsland.com","type":"other","credibility":3},{"url":"https://blog.1inch.com/cross-chain-bridge-vulnerabilities/","name":"blog.1inch.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, DOJ, or other government bodies related to ForceBridge or Magickbase have been identified in available sources as of May 2026. Magickbase has stated it is cooperating with local law enforcement. No arrests, indictments, or formal legal proceedings have been publicly reported in connection with the June 2025 exploit.","heading":"Regulatory and Legal Status","sources":[{"url":"https://www.okx.com/en-us/news/article/magickbase-3-7-million-funds-affected-due-hack-45867251099680","name":"okx.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-10-14","event":"ForceBridge launches on Nervos Network mainnet, enabling cross-chain transfers between CKB, Ethereum, Cardano, and Polkadot.","source":""},{"date":"2025-05-31","event":"Magickbase announces the sunset of ForceBridge and Godwoken, citing low user activity and high maintenance costs. Six-month withdrawal window announced.","source":""},{"date":"2025-06-02","event":"ForceBridge exploited via access control vulnerability (likely compromised private key). Approximately $3.7–3.9 million in ETH, USDC, USDT, DAI, and WBTC stolen across Ethereum and BNB Chain.","source":""},{"date":"2025-06-02","event":"Cyvers Alerts first detects and reports suspicious activity involving ForceBridge on X.","source":""},{"date":"2025-06-02","event":"Magickbase pauses all ForceBridge bridge contracts and announces investigation. Stolen funds are laundered through Tornado Cash and FixedFloat.","source":""},{"date":"2025-06-02","event":"Magickbase publicly discloses $3.7 million in affected funds and announces cooperation with law enforcement and partner exchanges.","source":""},{"date":"2025-06-02","event":"Halborn Security publishes technical post-mortem attributing hack to access control failure, noting suspicious timing relative to sunset announcement.","source":""},{"date":"2026-01-16","event":"Extended deadline for user withdrawals from Force Bridge. Remaining funds to be held in Magickbase custody.","source":""}],"sources_used":[{"url":"https://www.cryptoninjas.net/2021/10/14/nervos-force-bridge-now-live-to-allow-cross-chain-connection-to-ethereum-cardano-polkadot/","name":"cryptoninjas.net","type":"other","archive_url":"http://web.archive.org/web/20260124030959/https://www.cryptoninjas.net/2021/10/14/nervos-force-bridge-now-live-to-allow-cross-chain-connection-to-ethereum-cardano-polkadot/","credibility":3,"archive_timestamp":"2026-01-24T03:09:59+00:00"},{"url":"https://forkast.news/headlines/nervos-launches-cross-chain-force-bridge/","name":"forkast.news","type":"other","archive_url":"https://web.archive.org/web/20260829114921/https://forkast.news/nervos-launches-cross-chain-force-bridge/","credibility":3,"archive_timestamp":"2026-08-29T11:49:21+00:00"},{"url":"https://sunset.forcebridge.com/announcement","name":"sunset.forcebridge.com","type":"other","archive_url":"http://web.archive.org/web/20260418043725/https://sunset.forcebridge.com/announcement","credibility":3,"archive_timestamp":"2026-04-18T04:37:25+00:00"},{"url":"https://medium.com/nervosnetwork/nervos-launches-force-bridge-to-connect-ethereum-dapps-users-with-ckb-24450df468f4","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://mpost.io/cyvers-alerts-detects-3m-exploit-on-nervos-network-bridge-magickbase-suspends-contracts-amid-investigation/","name":"mpost.io","type":"other","archive_url":"https://web.archive.org/web/20260829081259/https://mpost.io/cyvers-alerts-detects-3m-exploit-on-nervos-network-bridge-magickbase-suspends-contracts-amid-investigation/","credibility":3,"archive_timestamp":"2026-08-29T08:12:59+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260513011046/https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","credibility":3,"archive_timestamp":"2026-05-13T01:10:46+00:00"},{"url":"https://crypto.news/nervos-network-suffers-major-exploit-as-3-9m-in-crypto-is-stolen-from-force-bridge/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251107212112/https://crypto.news/nervos-network-suffers-major-exploit-as-3-9m-in-crypto-is-stolen-from-force-bridge/","credibility":3,"archive_timestamp":"2025-11-07T21:21:12+00:00"},{"url":"https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829122054/https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/","credibility":3,"archive_timestamp":"2026-08-29T12:20:54+00:00"},{"url":"https://cryptonewsland.com/nervos-networks-force-bridge-breached-crypto-losses-reach-3-9-million/","name":"cryptonewsland.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://de.fi/blog/de-fi-rekt-report-june-2025-114-8-million-lost-across-11-exploits","name":"de.fi","type":"other","archive_url":"http://web.archive.org/web/20260611104335/https://de.fi/blog/de-fi-rekt-report-june-2025-114-8-million-lost-across-11-exploits","credibility":3,"archive_timestamp":"2026-06-11T10:43:35+00:00"},{"url":"https://beincrypto.com/crypto-hacks-nervos-force-bridge-bitopro-exchange/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251005225901/https://beincrypto.com/crypto-hacks-nervos-force-bridge-bitopro-exchange/","credibility":3,"archive_timestamp":"2025-10-05T22:59:01+00:00"},{"url":"https://www.okx.com/en-us/news/article/magickbase-3-7-million-funds-affected-due-hack-45867251099680","name":"okx.com","type":"other","archive_url":"https://web.archive.org/web/20260829091117/https://www.okx.com/en-us/orbit/news/magickbase-3-7-million-in-funds-affected-due-to-the-hack-45867251099680","credibility":3,"archive_timestamp":"2026-08-29T09:11:17+00:00"},{"url":"https://cryptorank.io/news/feed/89e3b-threat-actors-take-over-nervos-network","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260830032714/https://cryptorank.io/news/feed/89e3b-threat-actors-take-over-nervos-network","credibility":3,"archive_timestamp":"2026-08-30T03:27:14+00:00"},{"url":"https://sunset.forcebridge.com/","name":"sunset.forcebridge.com","type":"other","archive_url":"http://web.archive.org/web/20260418044628/https://sunset.forcebridge.com/","credibility":3,"archive_timestamp":"2026-04-18T04:46:28+00:00"},{"url":"https://blog.1inch.com/cross-chain-bridge-vulnerabilities/","name":"blog.1inch.com","type":"other","archive_url":"http://web.archive.org/web/20260317121031/https://blog.1inch.com/cross-chain-bridge-vulnerabilities/","credibility":3,"archive_timestamp":"2026-03-17T12:10:31+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:23.073627+00:00","updated_at":"2026-08-30T03:54:59.752294+00:00"}}