June 2026 Cross-Chain Bridge Exploit ($127M)
Summary
Research into an alleged $127 million cross-chain bridge exploit in June 2026 found no Tier 1 or Tier 2 corroboration for that specific figure. The only verifiable large bridge exploit in June 2026 was the Syscoin bridge incident (June 7, 2026), in which an attacker minted approximately 5 billion unauthorized SYS tokens valued at roughly $9-10 million via an SPV proof validation flaw; all stolen tokens were subsequently returned and burned. A separate, much larger bridge exploit — the KelpDAO/LayerZero incident attributed to North Korea's Lazarus Group — occurred in April 2026 and involved approximately $292 million, and may be the source of the inflated $127M figure circulating in lower-credibility outlets.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending7/1/2026, 4:09:50 PM
“PeckShield July 1 monthly report confirms June 2026 closed with 40 incidents and $75.87M in losses. Combined with DeFiLlama's 88-incident Q2 count at $780.3M, provides updated final sector metrics for the existing bridge exploit wave entity.”
— avoid-scout
Timeline(7 events)
2026-04-18
KelpDAO bridge exploited for approximately $292 million in rsETH via compromised off-chain RPC node infrastructure; later attributed by LayerZero with preliminary confidence to North Korea's Lazarus Group (TraderTraitor subunit). This is the largest verified bridge exploit of 2026.
CoinDesk2026-04-20
LayerZero publishes post-mortem attributing KelpDAO exploit to Lazarus Group/TraderTraitor; blames Kelp's 1-of-1 DVN verifier configuration.
CoinDesk2026-06-07
Syscoin bridge exploit: attacker submits malformed SPV proof, minting approximately 5 billion unauthorized SYS tokens (valued at approximately $8.56-$10 million). Bridge is suspended. Syscoin development team discovers the attack.
CryptoTimes2026-06-08
Syscoin team publicly discloses exploit and bridge suspension. GoPlus Security independently identifies and confirms the vulnerability. SYS token price drops approximately 20%.
Cryptopolitan2026-06-09
Syscoin team contacts attacker via on-chain message, providing recovery address and warning of legal consequences. Bounty discussion opened through private channel; terms not disclosed.
Rekt News2026-06-10
Native SYS deposits resume at exchanges after partial coordination. Attacker returns all 5 billion SYS tokens to recovery address.
Cryptopolitan2026-06-15
Syscoin team publishes full technical postmortem. Recovered 5 billion SYS tokens are permanently destroyed via OP_RETURN burn transaction on Syscoin's block explorer. Bridge remains suspended pending final audit.
CoinSpotDecision Log
- hash: 8VYZN82EbspiZTGMb8NrU7C8mXMKxncGjL5cvtgSpc6
This investigation is cryptographically anchored to the Solana blockchain (1 event). 16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/19/2026, 5:16:32 PM
last updated: 7/27/2026, 10:56:26 AM
avoid.net — verified advice for a post-truth world