{"investigation":{"slug":"xbridge","entity_name":"XBridge","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"XBridge is a cross-chain bridge protocol built by SaitaChain (formerly Saitama Inu), designed to connect Ethereum Mainnet and BNB Chain. On April 24, 2024, the protocol suffered a $1.44 million exploit caused by a critical access-control vulnerability in its smart contracts, with stolen funds subsequently routed through Tornado Cash. The parent company, Saitama LLC, faces U.S. federal charges of wire fraud and market manipulation, with CEO Manpreet Kohli arrested in the UK in October 2024 and facing extradition proceedings.","sections":[{"content":"On April 24, 2024, XBridge was exploited on both Ethereum Mainnet and BNB Chain due to a critical access-control vulnerability in its smart contracts. The attacker exploited a flaw in the listToken function, which allowed any external caller to claim ownership of tokens without verification of the original token owner or caller identity. Once token ownership was fraudulently set, the attacker invoked the withdrawTokens function to drain assets from the protocol. The attacker's address was identified as 0x0cfc28d16d07219249c6d6d6ae24e7132ee4caa7. Total losses were approximately $1.44 million: approximately $830,920 on Ethereum and $416,231 on BNB Chain. Approximately $198,604 of the stolen funds were subsequently laundered through Tornado Cash across both chains. SaitaChain publicly confirmed the breach, identified the attacker wallet, and stated it was coordinating with centralized exchanges to block transactions from the hacker's address.","heading":"Smart Contract Exploit (April 2024)","sources":[{"url":"https://medium.com/neptune-mutual/understanding-the-xbridge-exploit-d3d56c0dc19c","name":"medium.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2024/04/24/saitachains-xbridge-experienced-a-security-breach/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"XBridge is a product of SaitaChain, the blockchain ecosystem launched by Saitama LLC (originally branded as Saitama Inu). On October 9, 2024, the U.S. Department of Justice unsealed charges in the District of Massachusetts against 18 individuals and entities, including Saitama LLC and its CEO Manpreet Singh Kohli, for alleged wire fraud, market manipulation, and running unlicensed money transmitting businesses. The SEC simultaneously filed a civil complaint. Prosecutors allege Saitama engaged in wash trading and coordinated pump-and-dump schemes involving the SAITAMA and STC tokens, manipulating over 60 low-cap cryptocurrencies in coordination with market-maker firms including Gotbit, ZM Quant, CLS Global, and MyTradeMM. Saitama's peak alleged market valuation exceeded $7.5 billion. Internal Telegram messages cited in the indictment allegedly show Saitama manager Russell Armand discussing plans to 'create an illusion of massive buys and new holders' to 'incite ppl to buy more.' Kohli was arrested in the United Kingdom on October 7, 2024, and appeared in London court for extradition proceedings. He has sought dismissal of the charges, challenging SEC jurisdiction. The charges represent the first-ever criminal charges against financial services firms for market manipulation and wash trading in the cryptocurrency industry.","heading":"Parent Company: SEC and DOJ Charges Against Saitama LLC","sources":[{"url":"https://www.bnnbloomberg.ca/business/company-news/2024/10/09/crypto-firms-charged-with-market-manipulation-in-us-sting/","name":"bnnbloomberg.ca","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-ma/pr/eighteen-individuals-and-entities-charged-international-operation-targeting-widespread","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26155","name":"sec.gov","type":"other","credibility":3},{"url":"https://www.mlex.com/mlex/articles/2347836/crypto-chief-kohli-in-uk-court-for-us-extradition-bid-over-alleged-saitama-scam","name":"mlex.com","type":"other","credibility":3},{"url":"https://www.mlex.com/mlex/articles/2409142/saitama-crypto-chief-kohli-seeks-dismissal-of-us-fraud-manipulation-charges","name":"mlex.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Beyond the SEC and DOJ actions, SaitaChain and the broader Saitama ecosystem have attracted significant community and media skepticism. The FBI named Robo Inu, SaitaRealty, and SaitaChain as projects under investigation, alleging the companies made false statements about their cryptocurrencies and performed sham trades to fabricate investor interest. Following the October 2024 federal charges, Indian exchange SunCrypto suspended trading in STC coin effective October 10, 2024. Multiple community members alleged for several years prior that SaitaChain represented a continuation of the original Saitama Inu scheme under a rebranded identity. The saitachain.com domain has also been flagged by security researchers for hosting or being mimicked by phishing sites designed to drain user wallets via malicious contract signatures.","heading":"Broader SaitaChain Fraud Allegations","sources":[{"url":"https://academy.suncrypto.in/suncrypto-suspends-trading-for-saitachain/","name":"academy.suncrypto.in","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2024/04/24/saitachains-xbridge-experienced-a-security-breach/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://insidebitcoins.com/news/fbi-sting-created-nexfundai-crypto-token-to-bring-down-fraud-scheme","name":"insidebitcoins.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security researchers at Neptune Mutual analyzed the April 2024 exploit in detail. The root cause was identified as inadequate access control in the listToken function: callers could set themselves as token owners without any prior verification, and the withdrawTokens function then honored that fraudulently assigned ownership. Security recommendations issued post-exploit included immediate patching of access controls to restrict token ownership changes to verified original owners, and enhanced validation logic to verify the legitimacy of all withdrawals. No independent security audit report for XBridge was publicly disclosed prior to the exploit, and no evidence of a formal third-party audit has been identified.","heading":"Smart Contract Security Assessment","sources":[{"url":"https://medium.com/neptune-mutual/understanding-the-xbridge-exploit-d3d56c0dc19c","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the April 2024 exploit, approximately $198,604 of the stolen $1.44 million was routed through Tornado Cash, a sanctioned cryptocurrency mixing service. The use of Tornado Cash is consistent with a deliberate effort to obscure the origin and movement of stolen funds. The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash in August 2022; use of the mixer following that date constitutes a potential violation of U.S. sanctions law for U.S. persons. The remaining balance of stolen funds has not been publicly confirmed as recovered.","heading":"Funds Laundering via Tornado Cash","sources":[{"url":"https://medium.com/neptune-mutual/understanding-the-xbridge-exploit-d3d56c0dc19c","name":"medium.com","type":"other","credibility":3},{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"home.treasury.gov","type":"other","credibility":3}],"severity":"medium"},{"content":"As of the available research, the SaitaChain XBridge protocol remains in a highly uncertain operational state. The CEO of Saitama LLC (the ultimate parent of SaitaChain and XBridge) faces extradition proceedings in the UK and has sought dismissal of U.S. federal fraud charges. The STC token continues to be listed on some exchanges but saw suspension from SunCrypto following the October 2024 charges. The saitachain.com website domain was returning non-functional content as of mid-2025. No public disclosure of a recovery plan, post-exploit smart contract audit, or user compensation framework has been identified. The combination of a confirmed critical smart contract exploit, active federal criminal proceedings against leadership, and post-theft use of a sanctioned mixer represent compounding risk factors for any prospective user or investor.","heading":"Current Status and Operational Risk","sources":[{"url":"https://coinmarketcap.com/currencies/saitama-inu-new/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://academy.suncrypto.in/suncrypto-suspends-trading-for-saitachain/","name":"academy.suncrypto.in","type":"other","credibility":3},{"url":"https://www.mlex.com/mlex/articles/2347836/crypto-chief-kohli-in-uk-court-for-us-extradition-bid-over-alleged-saitama-scam","name":"mlex.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-08","event":"Saitama LLC incorporated in Massachusetts; launches SAITAMA meme token with alleged undisclosed insider sell-offs and wash trading.","source":""},{"date":"2023-01","event":"SaitaChain rebrands from Saitama Inu ecosystem; XBridge launched as cross-chain bridge product connecting Ethereum Mainnet and BNB Chain.","source":""},{"date":"2024-04-24","event":"XBridge exploited on Ethereum and BNB Chain via access-control vulnerability; $1.44 million stolen. Attacker address: 0x0cfc28d16d07219249c6d6d6ae24e7132ee4caa7. Approximately $198,604 laundered through Tornado Cash.","source":""},{"date":"2024-10-07","event":"Saitama LLC CEO Manpreet Singh Kohli arrested in the United Kingdom ahead of federal charges.","source":""},{"date":"2024-10-09","event":"U.S. DOJ unseals charges against 18 individuals and entities including Saitama LLC for wire fraud, market manipulation, and wash trading. SEC files civil complaint. SaitaChain named by FBI as a project under investigation.","source":""},{"date":"2024-10-10","event":"Indian exchange SunCrypto suspends trading of STC (SaitaChain Coin) in response to U.S. federal charges.","source":""},{"date":"2025-01","event":"Manpreet Kohli appears in London court for extradition proceedings; hearing adjourned pending trial date.","source":""},{"date":"2025-04","event":"Kohli files motion to dismiss U.S. fraud and market manipulation charges, challenging SEC jurisdiction.","source":""}],"sources_used":[{"url":"https://medium.com/neptune-mutual/understanding-the-xbridge-exploit-d3d56c0dc19c","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cryptotimes.io/2024/04/24/saitachains-xbridge-experienced-a-security-breach/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829151208/https://www.cryptotimes.io/2024/04/24/saitachains-xbridge-experienced-a-security-breach/","credibility":3,"archive_timestamp":"2026-08-29T15:12:08+00:00"},{"url":"https://www.bnnbloomberg.ca/business/company-news/2024/10/09/crypto-firms-charged-with-market-manipulation-in-us-sting/","name":"bnnbloomberg.ca","type":"other","archive_url":"https://web.archive.org/web/20260829144617/https://www.bnnbloomberg.ca/","credibility":3,"archive_timestamp":"2026-08-29T14:46:17+00:00"},{"url":"https://www.justice.gov/usao-ma/pr/eighteen-individuals-and-entities-charged-international-operation-targeting-widespread","name":"justice.gov","type":"other","archive_url":"http://web.archive.org/web/20260613045717/https://www.justice.gov/usao-ma/pr/eighteen-individuals-and-entities-charged-international-operation-targeting-widespread","credibility":3,"archive_timestamp":"2026-06-13T04:57:17+00:00"},{"url":"https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26155","name":"sec.gov","type":"other","archive_url":"http://web.archive.org/web/20260815175336/https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26155","credibility":3,"archive_timestamp":"2026-08-15T17:53:36+00:00"},{"url":"https://www.mlex.com/mlex/articles/2347836/crypto-chief-kohli-in-uk-court-for-us-extradition-bid-over-alleged-saitama-scam","name":"mlex.com","type":"other","archive_url":"http://web.archive.org/web/20260214233040/https://www.mlex.com/mlex/articles/2347836/crypto-chief-kohli-in-uk-court-for-us-extradition-bid-over-alleged-saitama-scam","credibility":3,"archive_timestamp":"2026-02-14T23:30:40+00:00"},{"url":"https://www.mlex.com/mlex/articles/2409142/saitama-crypto-chief-kohli-seeks-dismissal-of-us-fraud-manipulation-charges","name":"mlex.com","type":"other","archive_url":"http://web.archive.org/web/20260611004639/https://www.mlex.com/mlex/articles/2409142/saitama-crypto-chief-kohli-seeks-dismissal-of-us-fraud-manipulation-charges","credibility":3,"archive_timestamp":"2026-06-11T00:46:39+00:00"},{"url":"https://academy.suncrypto.in/suncrypto-suspends-trading-for-saitachain/","name":"academy.suncrypto.in","type":"other","archive_url":"http://web.archive.org/web/20260311155934/https://academy.suncrypto.in/suncrypto-suspends-trading-for-saitachain/","credibility":3,"archive_timestamp":"2026-03-11T15:59:34+00:00"},{"url":"https://insidebitcoins.com/news/fbi-sting-created-nexfundai-crypto-token-to-bring-down-fraud-scheme","name":"insidebitcoins.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"home.treasury.gov","type":"other","archive_url":"http://web.archive.org/web/20260822123118/https://home.treasury.gov/news/press-releases/jy0916","credibility":3,"archive_timestamp":"2026-08-22T12:31:18+00:00"},{"url":"https://coinmarketcap.com/currencies/saitama-inu-new/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260210002617/https://coinmarketcap.com/currencies/saitama-inu-new/","credibility":3,"archive_timestamp":"2026-02-10T00:26:17+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:33.215052+00:00","updated_at":"2026-08-30T01:16:27.50587+00:00"}}