{"investigation":{"slug":"iotex","entity_name":"IoTeX","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"IoTeX is a Layer 1 blockchain and DePIN (Decentralized Physical Infrastructure Network) platform founded in 2017 by Raullen Chai, Qevan Guo, Jing Sun, and Xinxin Fan, with its native IOTX token launched via ICO in 2018. In February 2026 the project suffered a significant security incident when a compromised private key on the Ethereum side of its ioTube cross-chain bridge allowed an attacker to drain approximately $4.3–$4.4 million in assets and mint 410 million unauthorized CIOTX tokens, with total estimated damages disputed between $4.4 million (official) and $8.8 million (PeckShield). Additional concerns include a prior market-maker-linked near-zero price anomaly on Binance in October 2025, governance centralization risks from its 36-delegate Roll-DPoS consensus model, and on-chain analyst reports alleging the attacker's wallet was funded by the same entity behind the $49 million Infini Finance hack of 2025.","sections":[{"content":"On February 21, 2026, a critical security incident affected the IoTeX ecosystem when an attacker exploited a compromised validator owner private key on the Ethereum side of the ioTube cross-chain bridge. This single key provided administrative control over two core contracts: the MintPool, which creates wrapped tokens, and the TokenSafe, which holds locked assets backing those wrapped tokens. Using these elevated privileges, the attacker drained approximately $4.3 million in tokens from the TokenSafe contract — including USDC, USDT, IOTX, WBTC, and BUSD — and minted an alleged 111–410 million unauthorized CIOTX tokens (sources differ on the exact figure). Independent security firm PeckShield estimated total damages above $8 million when including the minted tokens at market value, while IoTeX officially revised its acknowledged losses to approximately $4.4 million. The stolen liquid assets were swapped into ETH via Uniswap and bridged to Bitcoin through THORChain before containment could be applied, making full recovery difficult. IoTeX halted its Layer 1 chain entirely to freeze attacker addresses and offered a 10% white-hat bounty (~$440,000) with a 48-hour return window and a pledge of non-prosecution. Security firm Halborn characterized the root cause as an operational security failure — specifically the absence of multi-signature controls and hardware security modules for bridge administrator keys — rather than a smart contract vulnerability. Following the incident, IoTeX published IIP-56 proposing full deprecation of CIOTX across Ethereum, Base, Solana, BSC, and Polygon, with affected chain holders given a claims process to redeem IOTX at a 1:1 ratio. Over 86% of the 410 million maliciously minted CIOTX tokens were reported frozen before the attacker could liquidate them.","heading":"February 2026 ioTube Bridge Exploit","sources":[{"url":"https://www.coindesk.com/business/2026/02/23/iotex-bridge-exploit-sparks-debate-over-losses-and-recovery-prospects","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-iotex-hack-february-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/02/22/iotex-confirms-4-3m-iotube-bridge-breach-validator-key-compromised","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://phemex.com/blogs/iotex-bridge-hack-cross-chain-risk-negotiations","name":"phemex.com","type":"other","credibility":3},{"url":"https://coinpedia.org/news/iotex-suffers-8-million-hack-after-private-key-compromise/","name":"coinpedia.org","type":"other","credibility":3},{"url":"https://cryptonews.net/news/security/32489084/","name":"cryptonews.net","type":"other","credibility":3},{"url":"https://www.mexc.com/news/810924","name":"mexc.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analysts, including the pseudonymous researcher Specter, alleged that the wallet used to fund the IoTeX bridge attacker was linked to the $49 million exploit of Infini Finance, a stablecoin neobank, which occurred in February 2025. That incident involved a former contract developer who allegedly retained administrative privileges and drained Infini's vault. If the funding trail allegation is accurate, it suggests the IoTeX attack was not opportunistic but rather part of a coordinated, long-horizon campaign by a sophisticated threat actor conducting systematic multi-protocol infiltration. No formal law enforcement attribution has been made at the time of this investigation, and this claim should be treated as alleged pending independent verification.","heading":"Alleged Attacker Funding Link to Infini Finance Hack","sources":[{"url":"https://phemex.com/blogs/iotex-bridge-hack-cross-chain-risk-negotiations","name":"phemex.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/02/22/iotex-confirms-4-3m-iotube-bridge-breach-validator-key-compromised","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"In the immediate aftermath of the February 2026 exploit, three major South Korean cryptocurrency exchanges — Upbit, Bithumb, and Coinone — simultaneously suspended all IOTX deposit and withdrawal services while placing the token on investor protection watchlists, effectively signaling potential delisting risk. Spot trading of IOTX continued on these platforms but deposit and withdrawal functionality was frozen pending investigation. Binance also flagged and froze exchange deposits suspected of containing stolen assets. IOTX declined approximately 22% in the immediate aftermath, from around $0.0054 to $0.0042. The watchlist designations were subsequently removed by Upbit and Bithumb on approximately March 15, 2026, following IoTeX's publication of a security remediation roadmap, completion of new audits, and direct engagement with exchange compliance teams. Binance also reopened IOTX trading, and the token briefly recovered approximately 29%.","heading":"Exchange Watchlist Placements and Trading Suspensions","sources":[{"url":"https://bitcoinworld.co.in/upbit-bithumb-iotx-delisting-watchlist/","name":"bitcoinworld.co.in","type":"other","credibility":3},{"url":"https://www.mexc.com/news/766504","name":"mexc.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/upbit-suspends-iotex-trading-after-2-million-private-key-breach-62049","name":"phemex.com","type":"other","credibility":3},{"url":"https://en.bloomingbit.io/feed/news/108507","name":"en.bloomingbit.io","type":"other","credibility":3},{"url":"https://en.bloomingbit.io/feed/news/108508","name":"en.bloomingbit.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 10–11, 2025, IOTX displayed a near-zero price of '0.0000' on Binance, triggering widespread community alarm. IoTeX and Binance subsequently attributed the anomaly to a combination of reduced decimal precision on certain trading pairs, extreme market volatility triggered by new U.S. tariff announcements, and a third-party market maker malfunction. Binance clarified that the 'zero price' was a user interface display issue and that actual market prices never reached zero, with price charts corrected retroactively. The event nevertheless contributed to a 15–20% drop in IOTX value amid a broader 42% weekly decline. IoTeX announced a token buyback program and new liquidity partnerships in response, acknowledging the incident revealed fragility in the project's market liquidity infrastructure.","heading":"October 2025 Binance Price Anomaly and Market Maker Incident","sources":[{"url":"https://crypto.news/iotex-token-buybacks-liquidity-boost-iotx-price-2025/","name":"crypto.news","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/c881b-iotex-token-buybacks-binance-price-glitch","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/iotex-token-buybacks-binance-price-glitch/","name":"cryptopolitan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"IoTeX operates on a Roll-DPoS (Roll Delegated Proof of Stake) consensus mechanism in which 24 of the top 36 community-voted delegates are randomly selected each hour to produce blocks. Critics have raised concerns about the practical centralization this creates: the small active validator set of 36 represents a limited decentralization footprint compared to networks with hundreds or thousands of validators. Independent analyses have noted low governance voter turnout — one cited proposal (IIP-42) passed with approximately 60 voters and 31 million IOTX participating — and that the IoTeX Foundation and MachineFi Lab retain de facto implementation control over governance outcomes. IoTeX documentation acknowledges the delegate count is intended to increase over time to further mitigate centralization risk. The project has proposed a Marshall DAO structure under its IoTeX 2.0 roadmap to provide more distributed governance, though implementation timelines and impact remain to be evaluated.","heading":"Governance Centralization Concerns","sources":[{"url":"https://docs.iotex.io/depin-infra-modules-dim/iotex-l1-depin-blockchain/core-concepts/consensus-mechanism","name":"docs.iotex.io","type":"other","credibility":3},{"url":"https://ownyourmind.ai/projects/iotex/","name":"ownyourmind.ai","type":"other","credibility":3}],"severity":"medium"},{"content":"IoTeX has undergone multiple strategic pivots since its 2017 founding — from IoT (Internet of Things) blockchain infrastructure, to MachineFi (machine finance), to DePIN (Decentralized Physical Infrastructure Networks), and more recently to DePIN x AI and Edge AI positioning. Independent reviewers have described this pattern as 'narrative pivot fatigue' spanning eight years. While such repositioning is common in the crypto sector, the frequency of pivots raises questions about the project's ability to execute a consistent long-term vision. No specific fraud or deception has been attributed to these pivots; they represent a strategic communications concern rather than an operational misconduct finding.","heading":"Narrative Pivot History and Strategic Consistency","sources":[{"url":"https://ownyourmind.ai/projects/iotex/","name":"ownyourmind.ai","type":"other","credibility":3}],"severity":"medium"},{"content":"IoTeX raised approximately $70.52 million across five funding rounds, with its Token Generation Event (TGE) concluding on May 25, 2018. Total IOTX token supply is capped at 10 billion. The initial allocation assigned 24% to private sale investors (with a vesting schedule ending in November 2019), 25% to the IoTeX Foundation, and 15% to the core team with a 6-month cliff and 4-year vesting period. No specific fraud or misconduct has been documented in connection with the ICO or vesting schedule. No SEC enforcement action or securities law violation has been brought against IoTeX or IOTX; the project achieved MiCA compliance in the EU and separately received favorable regulatory context when the SEC issued a no-action letter for the related DoubleZero DePIN project in September 2025, which the IoTeX team cited as validation for its DePIN infrastructure approach.","heading":"Token Economics and ICO Background","sources":[{"url":"https://cryptorank.io/ico/iotex","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://icoanalytics.org/projects/iotex/","name":"icoanalytics.org","type":"other","credibility":3},{"url":"https://www.sec.gov/newsroom/speeches-statements/peirce-092925-deep-statement-doublezero-no-action-letter","name":"sec.gov","type":"other","credibility":3},{"url":"https://www.coindesk.com/news-analysis/2025/09/30/sec-s-bow-to-doublezero-carries-major-weight-for-decentralized-infrastructure-peirce","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The February 2026 exploit exposed a critical single-point-of-failure in the ioTube bridge architecture: a single unprotected private key held administrative control over the entire Ethereum-side bridge infrastructure. Security experts from Halborn noted that multi-signature wallet controls and hardware security module (HSM) cold storage practices — standard for custodial infrastructure of this value — were absent. In response, IoTeX committed to implementing multi-signature and 24-hour time-lock controls, pausing ioTube indefinitely pending a full independent security audit, and publishing IIP-55 to establish a dynamic witness committee for ioTube bridge governance. The ioTube bridge remained paused at the time of this investigation's primary research period. Prior audit history for the ioTube bridge by firms such as CertiK or SlowMist could not be independently verified through available public sources.","heading":"Infrastructure Security Posture and Post-Exploit Remediation","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-iotex-hack-february-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://hub.iotex.io/governance/iip-55-dynamic-witness-committee-for-iotube","name":"hub.iotex.io","type":"other","credibility":3},{"url":"https://www.kucoin.com/news/articles/iotex-security-incident-update-recovery-path-and-compensation-timeline-for-affected-users","name":"kucoin.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017","event":"IoTeX founded by Raullen Chai, Qevan Guo, Jing Sun, and Xinxin Fan with a focus on IoT blockchain infrastructure.","source":"","date_original":"2017-01-01"},{"date":"2018-05-25","event":"IoTeX Token Generation Event (TGE) concludes; project raises approximately $70.52 million across five funding rounds.","source":""},{"date":"2025-02","event":"Infini Finance suffers $49 million exploit; on-chain analysts later allege the IoTeX attacker's funding wallet traces back to this incident.","source":"","date_original":"2025-02-01"},{"date":"2025-09-29","event":"SEC Division of Corporation Finance issues no-action letter for DoubleZero's 2Z DePIN token, which IoTeX cites as validating its DePIN infrastructure strategy.","source":""},{"date":"2025-10-10","event":"IOTX displays near-zero '0.0000' price on Binance; subsequently attributed to a UI display bug and third-party market maker malfunction. IoTeX announces token buyback program.","source":""},{"date":"2026-02-20","event":"IoTeX ioTube bridge exploit begins: a compromised validator owner private key on Ethereum grants attacker administrative control over bridge contracts.","source":""},{"date":"2026-02-21","event":"On-chain analyst Specter publicly flags the IoTeX private key compromise at approximately 4:20 a.m. EST. Approximately $4.3 million in tokens drained from TokenSafe; up to 410 million CIOTX tokens minted without authorization. IOTX price falls ~22%.","source":""},{"date":"2026-02-21","event":"IoTeX validators coordinate to pause ioTube bridge; IoTeX halts its Layer 1 chain to freeze attacker addresses.","source":""},{"date":"2026-02-22","event":"IoTeX co-founder Raullen Chai publicly confirms the exploit, stating officially acknowledged losses of approximately $2 million (later revised to $4.4 million). A 10% white-hat bounty (~$440,000) offered for return of funds within 48 hours.","source":""},{"date":"2026-02-22","event":"Upbit, Bithumb, and Coinone suspend IOTX deposits and withdrawals; place token on investor protection watchlists.","source":""},{"date":"2026-02-23","event":"PeckShield estimates total damages above $8 million including value of minted tokens. IoTeX disputes figure, citing $4.4 million as confirmed loss.","source":""},{"date":"2026-03","event":"IoTeX publishes IIP-56 proposing full deprecation of CIOTX across all networks and a claims-based 1:1 redemption process for affected holders.","source":"","date_original":"2026-03-01"},{"date":"2026-03-12","event":"IIP-56 governance proposal vote concludes.","source":""},{"date":"2026-03-15","event":"Upbit and Bithumb remove IOTX from investor protection watchlists following IoTeX security remediation and audit completion.","source":""},{"date":"2026-03-20","event":"Binance reopens IOTX trading; token briefly recovers approximately 29%.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/business/2026/02/23/iotex-bridge-exploit-sparks-debate-over-losses-and-recovery-prospects","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260720142335/https://www.coindesk.com/business/2026/02/23/iotex-bridge-exploit-sparks-debate-over-losses-and-recovery-prospects","credibility":3,"archive_timestamp":"2026-07-20T14:23:35+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-iotex-hack-february-2026","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260609210019/https://www.halborn.com/blog/post/explained-the-iotex-hack-february-2026","credibility":3,"archive_timestamp":"2026-06-09T21:00:19+00:00"},{"url":"https://www.cryptotimes.io/2026/02/22/iotex-confirms-4-3m-iotube-bridge-breach-validator-key-compromised","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20260726101823/https://www.cryptotimes.io/2026/02/22/iotex-confirms-4-3m-iotube-bridge-breach-validator-key-compromised/","credibility":3,"archive_timestamp":"2026-07-26T10:18:23+00:00"},{"url":"https://phemex.com/blogs/iotex-bridge-hack-cross-chain-risk-negotiations","name":"phemex.com","type":"other","archive_url":"http://web.archive.org/web/20260731214358/https://phemex.com/blogs/iotex-bridge-hack-cross-chain-risk-negotiations","credibility":3,"archive_timestamp":"2026-07-31T21:43:58+00:00"},{"url":"https://coinpedia.org/news/iotex-suffers-8-million-hack-after-private-key-compromise/","name":"coinpedia.org","type":"other","archive_url":"https://web.archive.org/web/20260829025934/https://coinpedia.org/news/iotex-suffers-8-million-hack-after-private-key-compromise/","credibility":3,"archive_timestamp":"2026-08-29T02:59:34+00:00"},{"url":"https://cryptonews.net/news/security/32489084/","name":"cryptonews.net","type":"other","archive_url":"https://web.archive.org/web/20260829113929/https://cryptonews.net/news/security/32489084/","credibility":3,"archive_timestamp":"2026-08-29T11:39:29+00:00"},{"url":"https://www.mexc.com/news/810924","name":"mexc.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://bitcoinworld.co.in/upbit-bithumb-iotx-delisting-watchlist/","name":"bitcoinworld.co.in","type":"other","archive_url":"https://web.archive.org/web/20260829073323/https://bitcoinworld.co.in/upbit-bithumb-iotx-delisting-watchlist/","credibility":3,"archive_timestamp":"2026-08-29T07:33:23+00:00"},{"url":"https://www.mexc.com/news/766504","name":"mexc.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://phemex.com/news/article/upbit-suspends-iotex-trading-after-2-million-private-key-breach-62049","name":"phemex.com","type":"other","archive_url":"https://web.archive.org/web/20260830033939/https://phemex.com/news/article/upbit-suspends-iotex-trading-after-2-million-private-key-breach-62049","credibility":3,"archive_timestamp":"2026-08-30T03:39:39+00:00"},{"url":"https://en.bloomingbit.io/feed/news/108507","name":"en.bloomingbit.io","type":"other","archive_url":"http://web.archive.org/web/20260422231009/https://en.bloomingbit.io/feed/news/108507","credibility":3,"archive_timestamp":"2026-04-22T23:10:09+00:00"},{"url":"https://en.bloomingbit.io/feed/news/108508","name":"en.bloomingbit.io","type":"other","archive_url":"http://web.archive.org/web/20260411042549/https://en.bloomingbit.io/feed/news/108508","credibility":3,"archive_timestamp":"2026-04-11T04:25:49+00:00"},{"url":"https://crypto.news/iotex-token-buybacks-liquidity-boost-iotx-price-2025/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251112024354/https://crypto.news/iotex-token-buybacks-liquidity-boost-iotx-price-2025/","credibility":3,"archive_timestamp":"2025-11-12T02:43:54+00:00"},{"url":"https://cryptorank.io/news/feed/c881b-iotex-token-buybacks-binance-price-glitch","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829114257/https://cryptorank.io/news/feed/c881b-iotex-token-buybacks-binance-price-glitch","credibility":3,"archive_timestamp":"2026-08-29T11:42:57+00:00"},{"url":"https://www.cryptopolitan.com/iotex-token-buybacks-binance-price-glitch/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20251023083426/https://www.cryptopolitan.com/iotex-token-buybacks-binance-price-glitch/","credibility":3,"archive_timestamp":"2025-10-23T08:34:26+00:00"},{"url":"https://docs.iotex.io/depin-infra-modules-dim/iotex-l1-depin-blockchain/core-concepts/consensus-mechanism","name":"docs.iotex.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://ownyourmind.ai/projects/iotex/","name":"ownyourmind.ai","type":"other","archive_url":"https://web.archive.org/web/20260829040006/https://ownyourmind.ai/projects/iotex/","credibility":3,"archive_timestamp":"2026-08-29T04:00:06+00:00"},{"url":"https://cryptorank.io/ico/iotex","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20260609000449/https://cryptorank.io/ico/iotex","credibility":3,"archive_timestamp":"2026-06-09T00:04:49+00:00"},{"url":"https://icoanalytics.org/projects/iotex/","name":"icoanalytics.org","type":"other","archive_url":"http://web.archive.org/web/20260210212001/https://icoanalytics.org/projects/iotex/","credibility":3,"archive_timestamp":"2026-02-10T21:20:01+00:00"},{"url":"https://www.sec.gov/newsroom/speeches-statements/peirce-092925-deep-statement-doublezero-no-action-letter","name":"sec.gov","type":"other","archive_url":"http://web.archive.org/web/20260105142106/https://www.sec.gov/newsroom/speeches-statements/peirce-092925-deep-statement-doublezero-no-action-letter","credibility":3,"archive_timestamp":"2026-01-05T14:21:06+00:00"},{"url":"https://www.coindesk.com/news-analysis/2025/09/30/sec-s-bow-to-doublezero-carries-major-weight-for-decentralized-infrastructure-peirce","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251003155539/https://www.coindesk.com/news-analysis/2025/09/30/sec-s-bow-to-doublezero-carries-major-weight-for-decentralized-infrastructure-peirce","credibility":3,"archive_timestamp":"2025-10-03T15:55:39+00:00"},{"url":"https://hub.iotex.io/governance/iip-55-dynamic-witness-committee-for-iotube","name":"hub.iotex.io","type":"other","archive_url":"http://web.archive.org/web/20260316213707/https://hub.iotex.io/governance/iip-55-dynamic-witness-committee-for-iotube","credibility":3,"archive_timestamp":"2026-03-16T21:37:07+00:00"},{"url":"https://www.kucoin.com/news/articles/iotex-security-incident-update-recovery-path-and-compensation-timeline-for-affected-users","name":"kucoin.com","type":"other","archive_url":"https://web.archive.org/web/20260829050457/https://www.kucoin.com/news/articles/iotex-security-incident-update-recovery-path-and-compensation-timeline-for-affected-users","credibility":3,"archive_timestamp":"2026-08-29T05:04:57+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:13.272892+00:00","updated_at":"2026-08-30T03:54:57.208666+00:00"}}