← June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)reviewed 2026-10-28 · 9 claims checked
Fact-check findings
What an automated fact-checker found when it re-read June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Alleged Exploit Details (Unverified)
“a coordinated exploit began at 03:42 UTC on June 14, 2026 and ended by 03:54 UTC”
reviewerNadcab alleges the attack ran 03:42 to 03:54 UTC (about 12 minutes) and was a signature replay on validators lacking chain-specific nonces.The page presents a single clean 12-minute window and replay vector. The source itself is internally inconsistent: 03:54 is the detection time, and the FAQ contradicts the body on window, naming and vector. The page does not flag these internal contradictions. Also, the market-maker figures are described by Nadcab as locked/pending exposure, not confirmed losses, and a $11M unnamed firm is omitted. - #5[partially supported][awaiting moderator]in section: Indicators of Potential Fabricated or AI-Generated Content
“BridgeLink, CrossFlow and Relay Protocol do not appear in any blockchain analytics database, DEX registry or independent report”
reviewerBridgeLink, CrossFlow and Relay Protocol appear in no analytics database or independent report.Consistent with my web search, but a universal negative across all databases cannot be proven; I could not read DefiLlama's hack list directly.citeddefillama.com/hacks - #6[partially supported][awaiting moderator]in section: Verified June 2026 Bridge and DeFi Exploits
“malware on a developer's device exfiltrated seven private keys; three of six Gnosis Safe owner keys controlling a Hyperlane bridge ProxyAdmin on Ethereum were compromised”
reviewerHumanity Protocol exploit details: seven keys exfiltrated by malware, three of six Gnosis Safe keys, Hyperlane ProxyAdmin upgrade, 18,510 ETH and 1,548 BNB drained.Headline amount (~$30-32M) and the >80% token drop match, but the mechanism and asset breakdown are not in the cited CoinDesk page as fetched; they may come from a later update or another source. The Hyperlane/ETH/BNB specifics could not be verified from the cited URL. - #9[partially supported][awaiting moderator]in section: Verified June 2026 Bridge and DeFi Exploits
“Together these verified incidents total roughly $42–47M, well below the alleged $127M.”
reviewerVerified June incidents total roughly $42-47M.Arithmetic is consistent with ~30.8-36M + 9-10M + 1.7M = ~41.5-48M, but Syscoin's funds were fully returned so actual net loss is much lower; the sum mixes minted-token notional with real losses.
confirmed
5 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Alleged Exploit Details (Unverified)
“The post was published on June 17, 2026; no corroborating coverage has been identified since.”
reviewerThe $127M three-protocol exploit is asserted by a Nadcab Labs blog post, published June 17, 2026, with no Tier 1/2 corroboration.Nadcab post exists with the stated figures; my search found no independent coverage. - #3[confirmed][no action needed]in section: Alleged Exploit Details (Unverified)
“Market makers allegedly affected include Wintermute ($12M), Jump Crypto ($18M), GSR ($9M) and Amber Group ($7M).”
reviewerMarket makers allegedly affected: Wintermute $12M, Jump Crypto $18M, GSR $9M, Amber Group $7M.Accurately attributed and hedged as alleged. - #4[confirmed][no action needed]in section: Indicators of Potential Fabricated or AI-Generated Content
“its exploit occurred in February 2022 and involved about $320–325 million (roughly 120,000 wETH via a signature verification bypass)”
reviewerWormhole was exploited in February 2022 for about $320-325M, not in 2026.Well-established public fact (Feb 2, 2022, ~120,000 wETH, ~$325M); not re-fetched. - #7[confirmed][no action needed]in section: Syscoin Bridge Exploit (June 7, 2026): Incident and Mechanism
“On June 7, 2026, an unknown attacker exploited a proof validation vulnerability in Syscoin's native cross-chain bridge to mint about 5 billion unauthorized SYS.”
reviewerSyscoin: 5B SYS minted June 7, 2026, worth about $8.56M at $0.00171, a 568% supply increase; addresses and transactions per Rekt News.Figures and identifiers match Rekt exactly. - #8[confirmed][no action needed]in section: Syscoin: On-Chain Evidence and Fund Movement
“The Syscoin team's recovery address was sys1qdytsq5am9a7y6hweenl925g3yxtlrvl9fls0yg”
reviewerSyscoin recovery addresses and return transactions.Matches Rekt. Rekt also lists a spend tx ba6798fa... that the page omits (minor).
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.