Verify a decision

{"actor":"system:backfill","investigation_id":"189f2c30-e894-40b4-bc26-aadaf9209b93","kind":"publish","page_slug":"icon-icx","published_at":"2026-10-15T12:13:31.867Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ICON (ICX)","sections":[{"content":"ICON is a layer-one blockchain network launched in 2017 by a South Korean team, positioned as a chain-agnostic, interoperable blockchain using its Blockchain Transmission Protocol (BTP) for cross-chain token transfers and messaging. The network was co-founded by Min Kim, formerly chief strategy officer of DAYLI Financial Group, who also incubated ICON's technical partner ICONLOOP. ICON uses a delegated proof-of-stake (DPoS) consensus model in which ICX holders delegate tokens to elected Public Representatives (P-Reps), who produce blocks and participate in governance; becoming a P-Rep requires an on-chain registration and a 2,000 ICX fee. The network also runs a Contribution Proposal System for decentralized ecosystem grant funding.","heading":"Background","severity":"low","sources":[{"credibility":2,"name":"ICON (ICX) overview","type":"other","url":"https://coinmarketcap.com/currencies/icon/"},{"credibility":2,"name":"ICON price and overview","type":"other","url":"https://www.coinbase.com/en-fr/price/icon"}]},{"content":"According to ICON Foundation's own post-mortem, an attacker exploited a serialization defect introduced when a migration contract was changed to standardize withdrawal messages to a fixed 32-byte size. The contract's uniqueness check validated only the high-order bits of a message's serial number, while the cryptographic signature covered only the low 256 bits, which never changed across replays. This allowed the attacker to vary the unsigned high-order portion of two previously valid, signed withdrawal messages while the signature still verified as valid. Starting at 02:01:02 UTC on August 27, 2026, the attacker replayed the two messages 1,492 times over about 20 minutes, with 1,490 calls succeeding, releasing roughly 119,866,000 ICX and 531,600 bnUSD from foundation-held wallets into a single attacker-controlled relayer address. ICON states all affected assets were foundation-held and that no user deposits, balances, or positions were accessed or affected. The foundation says the defect was specific to its implementation, since other chains it supports used fixed-width integer handling that could not produce the same mismatch. The attacker had prepared roughly 11 hours earlier, opening a leveraged position on the Sonic network (supplying 2,000 USDC and borrowing 1,200 bnUSD) that was later used to launder and move exploited funds.","heading":"August 2026 Replay Exploit","severity":"critical","sources":[{"credibility":1,"name":"ICON Network Replay Exploit Post-Mortem","type":"official","url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"credibility":2,"name":"How a hacker reused the same authorization message 1,490 times to trigger massive crypto payout loops","type":"news_article","url":"https://cryptoslate.com/how-a-hacker-reused-the-same-authorization-message-1490-times-to-trigger-massive-crypto-payout-loops/"},{"credibility":2,"name":"ICON Says Replay Attack Reused Withdrawal Messages 1,492 Times","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/icon-replay-attack-icx-wallets-incident"}]},{"content":"ICON's monitoring system first alerted at 02:08 UTC, seven minutes into the exploit, but the post-mortem and secondary reporting indicate technical staff did not begin investigating until roughly 03:40 UTC, a gap of about 90 minutes, which ICON attributes mainly to an alert severity level that did not page on-call staff and an automatic shutdown trigger that was not yet enabled. By the time the affected contract was paused at 03:53 UTC, the attacker had already begun splitting stolen ICX across exchange deposit addresses (reported starting around 02:44 UTC). Exchanges were notified beginning at 04:46 UTC and suspended ICX deposits and withdrawals by 05:54 UTC. ICON halted the full network at 06:18:54 UTC on August 27, 2026, to freeze balances network-wide, and resumed operations at approximately 07:51 UTC on August 28, 2026 — a halt of roughly 25 hours. ICON reports that of the 119,866,000 ICX released, about 116.5 million was traced to two exchange deposit addresses, about 2 million was rejected and returned by a third exchange, and about 1.37 million was bridged back to the attacker's Sonic position; the foundation says most of the traced ICX remains frozen and recovery efforts are ongoing, though exact recovered amounts are described as provisional. The 531,600 bnUSD and 1,366,000 SODA exposure were reported fully recovered. ICON's confirmed net loss, after recovery, is approximately 150.2 ETH plus 31,204 USDC, representing proceeds the attacker converted and withdrew to Ethereum before controls took effect; ICON describes this residual amount as not recoverable.","heading":"Incident Response, Network Halt and Recovery","severity":"high","sources":[{"credibility":1,"name":"ICON Network Replay Exploit Post-Mortem","type":"official","url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"credibility":2,"name":"How a hacker reused the same authorization message 1,490 times to trigger massive crypto payout loops","type":"news_article","url":"https://cryptoslate.com/how-a-hacker-reused-the-same-authorization-message-1490-times-to-trigger-massive-crypto-payout-loops/"}]},{"content":"Secondary reporting on the incident notes that the migration contract containing the serialization defect had reportedly undergone a prior security audit, but none of that audit's nine disclosed findings flagged the serial-number mismatch that enabled the replay exploit; the audit's published scope is also reported not to have listed the affected migration-contract source. ICON is reported to have responded that the relay logic involved had been audited, but that the specific gap exploited fell outside the audit's findings. This is alleged criticism based on secondary crypto-news coverage rather than a confirmed audit scope dispute, and should be treated with that caveat pending any further ICON statement specifically addressing the audit-scope question.","heading":"Audit Gap and Security Oversight Criticism","severity":"high","sources":[{"credibility":2,"name":"How a hacker reused the same authorization message 1,490 times to trigger massive crypto payout loops","type":"news_article","url":"https://cryptoslate.com/how-a-hacker-reused-the-same-authorization-message-1490-times-to-trigger-massive-crypto-payout-loops/"}]},{"content":"Following the August 27, 2026 exploit, Upbit — South Korea's largest cryptocurrency exchange — placed ICX on its investment caution list in late August 2026. Upbit subsequently announced it will delist the ICX/KRW trading pair on October 19, 2026, attributing the decision to security incident risks surrounding ICON that it said were never resolved. Won-denominated trading is scheduled to stop at 3:00 p.m. KST on October 19, 2026, with any outstanding orders cancelled once support ends. Upbit will continue to support ICX withdrawals until November 18, 2026, after which the exchange says it will no longer process withdrawals, airdrops, wallet upgrades, migrations, or hard forks for the token. Secondary reporting states that the ICX/KRW pair was ICON's last major South Korean won market, directly affecting retail holders who rely on Upbit for ICX liquidity; this delisting concerns only Upbit's support for the trading pair and does not by itself mean the underlying ICON blockchain has ceased operating.","heading":"Upbit Delisting and Market Fallout","severity":"high","sources":[{"credibility":2,"name":"Upbit to Delist ICON (ICX) on October 19, 2026","type":"news_article","url":"https://www.kucoin.com/news/flash/upbit-to-delist-icon-icx-on-october-19-2026"},{"credibility":2,"name":"Upbit to remove ICX/KRW trading pair amid security concerns","type":"news_article","url":"https://coinfomania.com/upbit-to-remove-icx-krw-trading-pair-amid-security-concerns/"},{"credibility":2,"name":"Crypto News: Upbit to Delist ICX/KRW as Security Concerns Remain Unresolved","type":"news_article","url":"https://www.thecoinrepublic.com/2026/09/18/crypto-news-upbit-to-delist-icx-krw-as-security-concerns-remain-unresolved/"}]},{"content":"As of the delisting announcement, ICON's August 2026 incident remains only partially resolved: a confirmed net loss of approximately 150.2 ETH plus 31,204 USDC has not been recovered, and the exact final disposition of ICX frozen at exchanges had not been fully confirmed in ICON's own post-mortem. Upbit's decision to delist ICX/KRW, explicitly citing unresolved security risk, indicates that at least one major exchange counterparty assessed ICON's remediation as insufficient to restore confidence by mid-October 2026. This combination of an unresolved residual loss, an alleged audit-scope gap, and a major exchange delisting over continuing security concerns represents an ongoing, unresolved risk factor for ICX holders rather than a closed incident.","heading":"Outstanding Risk and Unresolved Status","severity":"medium","sources":[{"credibility":1,"name":"ICON Network Replay Exploit Post-Mortem","type":"official","url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"credibility":2,"name":"Upbit to Delist ICON (ICX) on October 19, 2026","type":"news_article","url":"https://www.kucoin.com/news/flash/upbit-to-delist-icon-icx-on-october-19-2026"}]}],"sources_used":[{"credibility":1,"name":"ICON Network Replay Exploit Post-Mortem","type":"official","url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"credibility":2,"name":"How a hacker reused the same authorization message 1,490 times to trigger massive crypto payout loops","type":"news_article","url":"https://cryptoslate.com/how-a-hacker-reused-the-same-authorization-message-1490-times-to-trigger-massive-crypto-payout-loops/"},{"credibility":2,"name":"ICON Says Replay Attack Reused Withdrawal Messages 1,492 Times","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/icon-replay-attack-icx-wallets-incident"},{"credibility":2,"name":"Upbit to Delist ICON (ICX) on October 19, 2026","type":"news_article","url":"https://www.kucoin.com/news/flash/upbit-to-delist-icon-icx-on-october-19-2026"},{"credibility":2,"name":"Upbit to remove ICX/KRW trading pair amid security concerns","type":"news_article","url":"https://coinfomania.com/upbit-to-remove-icx-krw-trading-pair-amid-security-concerns/"},{"credibility":2,"name":"Crypto News: Upbit to Delist ICX/KRW as Security Concerns Remain Unresolved","type":"news_article","url":"https://www.thecoinrepublic.com/2026/09/18/crypto-news-upbit-to-delist-icx-krw-as-security-concerns-remain-unresolved/"},{"credibility":2,"name":"ICON (ICX) overview","type":"other","url":"https://coinmarketcap.com/currencies/icon/"},{"credibility":2,"name":"ICON price and overview","type":"other","url":"https://www.coinbase.com/en-fr/price/icon"}],"summary":"ICON is a South Korean-founded layer-1 blockchain, launched in 2017 and co-founded by Min Kim, that uses delegated proof-of-stake governance and a cross-chain messaging layer (BTP). On August 27, 2026, an attacker exploited a serialization flaw in a migration contract to replay two signed withdrawal messages 1,490 times, draining foundation-held ICX and bnUSD and forcing a roughly 25-hour full network halt. Although ICON says user deposits were unaffected and most funds were recovered or frozen, a residual loss remains outstanding, a post-incident audit gap has drawn criticism, and South Korea's largest exchange, Upbit, is delisting the ICX/KRW pair on October 19, 2026 over unresolved security-risk concerns.","timeline":[{"date":"2017","event":"ICON network launched by a South Korean team, co-founded by Min Kim, aiming to build an interoperable, chain-agnostic blockchain.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/icon/"},{"date":"2026-08","date_evidence":"26 August, 15:00:58 to 15:07:35 UTC: the attacker opened a money market position on Sonic (2,000 USDC supplied, 1,200 bnUSD borrowed), about 11 hours before the exploit.","date_original":"2026-08-26","event":"Attacker opens a leveraged position on Sonic in preparation for the exploit.","source":"ICON Network Replay Exploit Post-Mortem","source_url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"date":"2026-08-27","date_evidence":"Exploit window: 02:01:02 to 02:21:12 UTC, 27 August 2026 (about 20 minutes).","event":"Attacker replays two signed withdrawal messages 1,492 times, draining roughly 119.9M ICX and 531,600 bnUSD from foundation-held wallets.","source":"ICON Network Replay Exploit Post-Mortem","source_url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"date":"2026-08","date_evidence":"Halted at 06:18:54 UTC on 27 August and resumed at approximately 07:51 UTC on 28 August, about 25 hours later.","date_original":"2026-08-27","event":"ICON halts the entire network to freeze balances following the exploit.","source":"ICON Network Replay Exploit Post-Mortem","source_url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"date":"2026-08","date_evidence":"Halted at 06:18:54 UTC on 27 August and resumed at approximately 07:51 UTC on 28 August, about 25 hours later.","date_original":"2026-08-28","event":"ICON network resumes operations after approximately 25-hour halt.","source":"ICON Network Replay Exploit Post-Mortem","source_url":"https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem"},{"date":"2026-08","date_evidence":"The exploit occurred on Aug. 27, and ICON's postmortem was dated Aug. 30.","date_original":"2026-08-30","event":"ICON Foundation publishes its post-mortem of the replay exploit.","source":"CryptoSlate","source_url":"https://cryptoslate.com/how-a-hacker-reused-the-same-authorization-message-1490-times-to-trigger-massive-crypto-payout-loops/"},{"date":"2026-08","event":"Upbit places ICX on its investment caution list following the exploit.","source":"The Coin Republic","source_url":"https://www.thecoinrepublic.com/2026/09/18/crypto-news-upbit-to-delist-icx-krw-as-security-concerns-remain-unresolved/"},{"date":"2026-10-19","date_evidence":"Upbit will end trading support for ICON's ICX token by delisting the ICX/KRW pair on October 19, 2026.","event":"Upbit delists the ICX/KRW trading pair, citing unresolved security risk from the August exploit.","source":"KuCoin News (Upbit delisting flash)","source_url":"https://www.kucoin.com/news/flash/upbit-to-delist-icon-icx-on-october-19-2026"},{"date":"2026-11-18","date_evidence":"holders must complete their withdrawals by November 18, 2026.","event":"Deadline for ICX withdrawals from Upbit after delisting.","source":"KuCoin News (Upbit delisting flash)","source_url":"https://www.kucoin.com/news/flash/upbit-to-delist-icon-icx-on-october-19-2026"}]},"v":1}