Multichain MPC bridge sees $100M+ outflows, sparking fears of exploit

Abnormally large outflows from the Multichain MPC bridge platform on July 6 have sparked fears that an exploit could be underway. Over $102 million worth of crypto has been withdrawn from Multichain’s Fantom bridge on the Ethereum side, as well as $666,000 from Dogechain and $5 million from Moonriver.

Multichain likely hacked. Exit all multichain assets. Good idea to revoke approvals to multichain bridge if you had any

— Curve Finance (@CurveFinance) July 6, 2023

On July 6, 7,214 Wrapped Ether (WETH) tokens (worth $13.6 million), 1,024 Wrapped Bitcoin (WBTC) (worth $31 million) and $58 million worth of US Dollar Coin (USDC) were withdrawn from the Fantom bridge’s Ethereum smart contract, with a total of approximately $102 million in cryptocurrency withdrawn.

In addition, the Dogechain bridge’s Ethereum contract saw a withdrawal of $666,000, which represented more than 86% of its total deposits, leaving only around $100,000 worth of assets remaining in the bridge. $5,872,661 worth of USDC and Tether (USDT) were withdrawn from the Multichain Moonriver bridge contracts on Ethereum, leaving only around $700,000 remaining on it.

Several on-chain sleuths took to Twitter to label the event as a possible exploit. Blockchain security firm Peckshield tagged the Multichain team in a post showing the Fantom bridge transactions, saying “You may want to take a look.”

Hi @MultichainOrg you may want to take a look: https://t.co/D4GKGpuBtw pic.twitter.com/3qURqGmes8

— PeckShield Inc. (@peckshield) July 6, 2023

This led one commenter to remark that it looks like “another massive hack.” On-chain investigator Spreek posted the Dogechain transactions with the comment “dogechain multichain drained.”

Cointelegraph could not confirm by the time of publication whether the contracts were “drained” or whether a large amount of funds were simply withdrawn by users. 

Cointelegraph reached out to the Multichain team on their Discord channel, but did not get a response by the time of publication. Multichain’s last post on Twitter was June 29.

Related: Poly Network urges users to withdraw after exploit affects 57 crypto assets

Multichain is a multi-party computation (MPC) bridging network. When a user wants to bridge assets from one chain to another, the Multichain network first confirms that the assets have been locked on the first chain and then mints derivative…