{"investigation":{"slug":"multichain","entity_name":"Multichain","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Multichain (formerly AnySwap) was a cross-chain bridge protocol that collapsed in mid-2023 following the arrest of its CEO Zhaojun by Chinese police in May 2023, which resulted in the seizure of private keys controlling over $1.5 billion in user assets. On July 7, 2023, approximately $126–127 million was drained from Multichain bridge reserves in transfers widely attributed to Chinese authorities or insiders with access to the CEO's confiscated key material. The protocol formally ceased operations on July 14, 2023, leaving users with unrecoverable losses.","sections":[{"content":"Multichain began as AnySwap, a cross-chain decentralized exchange founded in July 2020 to enable token transfers across disparate blockchain networks. In early 2021, the project pivoted away from exchange functionality and repositioned as a pure cross-chain bridge and router protocol, subsequently rebranding to Multichain. The protocol used a multi-party computation (MPC) system to secure bridged assets: funds were locked in MPC-controlled smart contracts on source chains and corresponding wrapped tokens were minted on destination chains. In December 2021, Multichain raised a $60 million financing round at a $1.2 billion valuation led by Binance Labs, with participation from Sequoia China, IDG Capital, Three Arrows Capital, DeFiance Capital, Circle Ventures, and others. At its peak, the protocol facilitated bridging across more than 50 chains and held a total value locked (TVL) exceeding $10 billion, making it one of the largest cross-chain bridge protocols in the DeFi ecosystem.","heading":"Background","sources":[{"url":"https://www.prnewswire.com/news-releases/multichain-previously-anyswap-raises-a-60m-financing-round-led-by-binance-labs-301448810.html","name":"","type":"other","credibility":3},{"url":"https://creditcoin.org/blog/life-after-multichain/","name":"","type":"other","credibility":3},{"url":"https://li.fi/knowledge-hub/multichain-a-deep-dive/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 21, 2023, Multichain CEO Zhaojun He was detained by Chinese police in Kunming and was immediately cut off from all communication with his global team. Chinese authorities confiscated all of his personal devices, computers, phones, hardware wallets, and the mnemonic phrases securing the protocol's MPC node infrastructure. Critically, Zhaojun had maintained centralized control over the server infrastructure and cryptographic key material underlying the bridge — a design that directly contradicted Multichain's stated promise of decentralized multi-party control. Access to MPC node servers, which were tied to Zhaojun's personal cloud accounts, was revoked. The broader Multichain team had no alternative means of accessing or operating the protocol. The arrest was not publicly disclosed until July 2023, weeks after the resulting exploit. The Singapore High Court subsequently found that the Multichain CEO 'had ultimate privileges and control over the cryptocurrency assets stored in the Multichain Bridge,' in direct breach of the User Agreement's representation that the platform operated through 'decentralised safe and secure multi-party computation nodes incapable of one-person control.'","heading":"CEO Arrest & Key Custody","sources":[{"url":"https://www.bloomberg.com/news/articles/2023-07-14/crypto-bridge-multichain-shuts-down-says-chinese-police-arrested-ceo","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/07/14/crypto-bridging-protocol-multichain-ceases-operations","name":"","type":"other","credibility":3},{"url":"https://www.elitigation.sg/gd/s/2024_SGHC_173","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/multichain-halts-use-of-crypto-bridge-saying-ceo-arrested/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 6–7, 2023, approximately $126–127 million in assets was drained from multiple Multichain bridge reserves in transactions described by the protocol as 'abnormal.' The largest single pool affected was the Fantom bridge, from which nearly $120 million was removed, primarily consisting of wrapped Ether (wETH), wrapped Bitcoin (wBTC), USDC, DAI, LINK, and Tether (USDT). The Dogecoin bridge lost approximately $666,000 — representing 85% of its total deposits — and the Moon River bridge lost approximately $6.8 million. Two days after the drain, Zhaojun's sister allegedly accessed customer assets held in MPC wallets — using login credentials obtained from Zhaojun's cloud server via an IP address in Kunming — and transferred additional crypto holdings to wallets under her control, in what she characterised as 'asset preservation.' On July 13, 2023, Zhaojun's family informed the Multichain team that his sister had also been taken into custody by Chinese police. Circle and Tether subsequently froze approximately $65 million of the stolen assets by blacklisting the destination addresses, limiting but not eliminating the losses. The nature of the drain — whether executed by Chinese authorities using seized keys, by Zhaojun's sister acting independently, or by other insiders — was never publicly confirmed.","heading":"The $126M Drain","sources":[{"url":"https://unchainedcrypto.com/hack-or-rugpull-multichain-sees-126-million-abnormal-outflows/","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/238299/multichain-warning-outflow","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/147622/126m-multichain-funds-abnormally-moved-unknown-address-says-project","name":"","type":"other","credibility":3},{"url":"https://www.crowdfundinsider.com/2023/07/210074-multichain-halts-operations-as-ceo-zhaojuns-sister-now-detained-by-chinese-authorities-might-be-holding-220m-of-funds/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain analytics firm Chainalysis analyzed the Multichain exploit and characterized it as either a compromise of MPC private key shards or an insider operation. Chainalysis noted that the attacker did not immediately swap centralized stablecoins such as USDC, an unusual pattern inconsistent with external hackers who typically move funds quickly to avoid freezes. This behavior is consistent with actors who either did not anticipate stablecoin blacklisting or prioritized moving native assets first. Total outflows across all affected chains — including Ethereum, BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Fantom, Cronos, and Moonbeam — reached approximately $265 million when accounting for all suspicious movement in the period, of which an estimated $65.82 million was subsequently frozen by Circle and Tether. The Singapore High Court noted that 'numerous secondary transfers' occurred following the initial drain, complicating asset tracing. On-chain investigators and the Fantom Foundation's CEO Michael Kong ultimately revised his initial assessment that insiders were not responsible, stating that his 'view has kind of changed' after a mysterious $1 million arbitrage event exploited a brief, unauthorized reopening of the bridge in November 2023 — an event Kong attributed to former Multichain team members.","heading":"On-Chain Evidence","sources":[{"url":"https://www.chainalysis.com/blog/multichain-exploit-july-2023/","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/singapore-court-fuels-view-multichain-hack-was-inside-job/","name":"","type":"other","credibility":3},{"url":"https://protos.com/multichain-protocol-secretly-restarts-to-another-1-million-exploit/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"No formal SEC or CFTC enforcement action against Multichain has been publicly identified. The primary legal proceedings to date have been civil, originating in Singapore. The Fantom Foundation sued both Multichain Foundation Ltd and Multichain Pte Ltd — the latter of which was incorporated shortly before the July 2023 breach, a circumstance the court noted raised suspicions about potential asset sheltering. On January 30, 2024, Fantom obtained a default judgment against both entities (neither defended the claims), and on July 8, 2024, Singapore Judicial Commissioner Mohamed Faizal ruled that Multichain owed the Fantom Foundation US$2,187,870.55 in damages. The ruling was grounded in breach of the User Agreement and the court's finding that the CEO held singular, unauthorized control over bridge assets. Chinese authorities conducted their own criminal investigation, with Zhaojun detained on unspecified charges in May 2023; Chinese law enforcement reportedly tracked funds from separate criminal scam activity through Multichain infrastructure, which triggered the initial detention. Zhaojun's Telegram activity briefly resurfaced in January 2024, prompting speculation about his status, but no formal charges or sentencing have been publicly confirmed by Chinese authorities. Legal observers have noted that the Fantom Foundation's Singapore judgment could enable appointment of a third-party liquidator to attempt asset recovery from Multichain's corporate entities.","heading":"Regulatory & Legal Context","sources":[{"url":"https://www.elitigation.sg/gd/s/2024_SGHC_173","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/singapore-court-fuels-view-multichain-hack-was-inside-job/","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2117693","name":"","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2024/01/16/multichain-ceo-resurfaces-amid-speculation-over-his-release/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Multichain represents one of the most severe bridge failures in DeFi history and exhibits multiple compounding risk factors. First, the protocol's MPC architecture was fundamentally undermined by the centralization of key custody in a single individual — the CEO — contrary to its public representations. This single point of failure directly enabled the July 2023 drain. Second, the collapse was triggered not by a smart contract exploit but by a regulatory event in a foreign jurisdiction, illustrating the cross-jurisdictional legal risks inherent in protocols operated by teams in restrictive regulatory environments. Third, user funds totaling hundreds of millions of dollars were rendered inaccessible and ultimately unrecoverable through no fault of the users themselves. Fourth, the protocol formally ceased operations on July 14, 2023, and has not resumed legitimate service. A brief, unauthorized restart in November 2023 resulted in an additional $1 million exploit. Recovery prospects for affected users remain extremely limited: approximately $65 million in frozen stablecoins is subject to ongoing legal proceedings, and the Singapore default judgment provides a legal pathway for creditor claims, but practical recovery is uncertain. Multichain should be considered permanently non-operational and any funds sent to its bridge contracts as unrecoverable. The protocol's collapse has been widely cited as a cautionary example of the risks posed by centralized key custody in ostensibly decentralized bridge infrastructure.","heading":"Risk Assessment","sources":[{"url":"https://www.chainalysis.com/blog/multichain-exploit-july-2023/","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-multichain-hack-july-2023","name":"","type":"other","credibility":3},{"url":"https://protos.com/multichain-protocol-secretly-restarts-to-another-1-million-exploit/","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/multichain-stops-operations-over-lack-of-funds","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-07-20","event":"AnySwap launched as a cross-chain decentralized exchange by CEO Zhaojun.","source":""},{"date":"2021-12-21","event":"Multichain (formerly AnySwap) raises $60 million at a $1.2 billion valuation led by Binance Labs, with Sequoia China, IDG Capital, and Three Arrows Capital among investors.","source":""},{"date":"2022","event":"Multichain TVL exceeds $10 billion at peak, making it one of the largest cross-chain bridge protocols in DeFi.","source":"","date_original":"2022-01-01"},{"date":"2023-05-21","event":"CEO Zhaojun He is detained by Chinese police in Kunming. His devices, hardware wallets, mnemonic phrases, and cloud server credentials — which controlled the bridge's MPC infrastructure — are confiscated.","source":""},{"date":"2023-05-31","event":"Multichain team publicly acknowledges inability to contact Zhaojun, citing unexplained operational disruptions.","source":""},{"date":"2023-07-06","event":"Approximately $126–127 million in assets begins draining from Multichain's Fantom, Dogecoin, and Moon River bridges. Multichain issues an 'abnormal' outflow warning.","source":""},{"date":"2023-07-09","event":"Zhaojun's sister allegedly accesses remaining customer funds via Zhaojun's cloud server credentials and transfers assets to wallets under her control, describing it as 'asset preservation.'","source":""},{"date":"2023-07-13","event":"Zhaojun's sister is taken into custody by Chinese police.","source":""},{"date":"2023-07-14","event":"Multichain formally announces cessation of all operations, citing the CEO's arrest, loss of server access, and inability to obtain operational funds.","source":""},{"date":"2023-11","event":"Multichain bridge briefly and secretly reopens; an additional $1 million is exploited. Fantom Foundation CEO attributes the event to former Multichain team members.","source":"","date_original":"2023-11-01"},{"date":"2024-01-16","event":"Zhaojun's Telegram status changes to 'last seen recently,' fueling speculation about his status in Chinese custody.","source":""},{"date":"2024-01-30","event":"Fantom Foundation obtains default judgment against Multichain Foundation Ltd and Multichain Pte Ltd in Singapore courts; neither entity contested the claims.","source":""},{"date":"2024-07-08","event":"Singapore High Court (Judicial Commissioner Mohamed Faizal) rules Multichain owes Fantom Foundation US$2,187,870.55, finding the CEO held centralized control over bridge assets in breach of the User Agreement.","source":""}],"sources_used":[{"url":"https://www.prnewswire.com/news-releases/multichain-previously-anyswap-raises-a-60m-financing-round-led-by-binance-labs-301448810.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20251217075515/https://www.prnewswire.com/news-releases/multichain-previously-anyswap-raises-a-60m-financing-round-led-by-binance-labs-301448810.html","credibility":3,"archive_timestamp":"2025-12-17T07:55:15+00:00"},{"url":"https://creditcoin.org/blog/life-after-multichain/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260509131645/https://creditcoin.org/blog/life-after-multichain/","credibility":3,"archive_timestamp":"2026-05-09T13:16:45+00:00"},{"url":"https://li.fi/knowledge-hub/multichain-a-deep-dive/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260514154508/https://li.fi/knowledge-hub/multichain-a-deep-dive/","credibility":3,"archive_timestamp":"2026-05-14T15:45:08+00:00"},{"url":"https://www.bloomberg.com/news/articles/2023-07-14/crypto-bridge-multichain-shuts-down-says-chinese-police-arrested-ceo","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2023/07/14/crypto-bridging-protocol-multichain-ceases-operations","name":"","type":"other","archive_url":"http://web.archive.org/web/20260215154202/https://www.coindesk.com/business/2023/07/14/crypto-bridging-protocol-multichain-ceases-operations","credibility":3,"archive_timestamp":"2026-02-15T15:42:02+00:00"},{"url":"https://www.elitigation.sg/gd/s/2024_SGHC_173","name":"","type":"other","archive_url":"http://web.archive.org/web/20260116131016/https://www.elitigation.sg/gd/s/2024_SGHC_173","credibility":3,"archive_timestamp":"2026-01-16T13:10:16+00:00"},{"url":"https://www.dlnews.com/articles/defi/multichain-halts-use-of-crypto-bridge-saying-ceo-arrested/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260617151347/https://www.dlnews.com/articles/defi/multichain-halts-use-of-crypto-bridge-saying-ceo-arrested/","credibility":3,"archive_timestamp":"2026-06-17T15:13:47+00:00"},{"url":"https://unchainedcrypto.com/hack-or-rugpull-multichain-sees-126-million-abnormal-outflows/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.theblock.co/post/238299/multichain-warning-outflow","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/147622/126m-multichain-funds-abnormally-moved-unknown-address-says-project","name":"","type":"other","archive_url":"http://web.archive.org/web/20260613092411/https://decrypt.co/147622/126m-multichain-funds-abnormally-moved-unknown-address-says-project","credibility":3,"archive_timestamp":"2026-06-13T09:24:11+00:00"},{"url":"https://www.crowdfundinsider.com/2023/07/210074-multichain-halts-operations-as-ceo-zhaojuns-sister-now-detained-by-chinese-authorities-might-be-holding-220m-of-funds/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.chainalysis.com/blog/multichain-exploit-july-2023/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260412024329/https://www.chainalysis.com/blog/multichain-exploit-july-2023/","credibility":3,"archive_timestamp":"2026-04-12T02:43:29+00:00"},{"url":"https://www.dlnews.com/articles/defi/singapore-court-fuels-view-multichain-hack-was-inside-job/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260630181855/https://www.dlnews.com/articles/defi/singapore-court-fuels-view-multichain-hack-was-inside-job/","credibility":3,"archive_timestamp":"2026-06-30T18:18:55+00:00"},{"url":"https://protos.com/multichain-protocol-secretly-restarts-to-another-1-million-exploit/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612234854/https://protos.com/multichain-protocol-secretly-restarts-to-another-1-million-exploit/","credibility":3,"archive_timestamp":"2026-06-12T23:48:54+00:00"},{"url":"https://www.chaincatcher.com/en/article/2117693","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830045514/https://www.chaincatcher.com/en/article/2117693","credibility":3,"archive_timestamp":"2026-08-30T04:55:14+00:00"},{"url":"https://www.cryptotimes.io/2024/01/16/multichain-ceo-resurfaces-amid-speculation-over-his-release/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829151035/https://www.cryptotimes.io/2024/01/16/multichain-ceo-resurfaces-amid-speculation-over-his-release/","credibility":3,"archive_timestamp":"2026-08-29T15:10:35+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-multichain-hack-july-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260415062202/https://www.halborn.com/blog/post/explained-the-multichain-hack-july-2023","credibility":3,"archive_timestamp":"2026-04-15T06:22:02+00:00"},{"url":"https://cointelegraph.com/news/multichain-stops-operations-over-lack-of-funds","name":"","type":"other","archive_url":"http://web.archive.org/web/20251123195350/https://cointelegraph.com/news/multichain-stops-operations-over-lack-of-funds","credibility":3,"archive_timestamp":"2025-11-23T19:53:50+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:40.715383+00:00","updated_at":"2026-08-30T05:14:10.808519+00:00"}}