The registry for what happened after cross-chain bridge incidents.

On September 11, 2026, Blockaid-derived reports identified anomalous Symbiosis BridgeV2-signed syBTC activity on BNB Smart Chain. The beneficiary later sold about 4.39 WBTC on Ethereum for roughly $336,000. Root cause and final loss remain unresolved.

At approximately 21:00 UTC on August 27, 2026, infrastructure providers running validator nodes in the SKALE Network were compromised and the Ethereum-connected SKALE IMA Bridge was exploited. The attacker drained ERC-20 assets held in affected bridge infrastructure. SKALE immediately paused the bridge and began investigating the exact attack vector, total loss and recovery options. SKALE on Base was explicitly reported as unaffected.

Beginning around 23:41 UTC on August 21, 2026, an attacker exploited contracts associated with The Sandbox SAND bridge configuration on Base and BNB Smart Chain, enabling unbacked SAND minting without corresponding Ethereum deposits. Independent reporting based on the operator postmortem states that 14,742,341.84 SAND was drained from the Ethereum backing vault. The affected bridge paths were disabled and The Sandbox later opened a compensation process for eligible users.

On August 18, 2026, an attacker used a single transaction containing 23 messages to chain multiple MAYAChain accounting and state-handling defects. The sequence triggered a false theft condition and an unfunded slash-subsidy credit in the thin ARB.LINK pool, after which the attacker gained near-total pool ownership and extracted Bitcoin and other assets. Maya halted MAYAChain trading for containment and recovery work.

On April 18, 2026, attackers compromised LayerZero Labs internal RPC infrastructure and simultaneously disrupted an external RPC path. Poisoned RPC responses caused the sole LayerZero Labs DVN configured for KelpDAO’s rsETH OApp to attest to a forged cross-chain message. With a 1-of-1 DVN configuration, the destination accepted that attestation and released 116,500 rsETH on Ethereum even though no corresponding burn occurred on Unichain.

On August 27, 2026, an attacker replayed two previously legitimate signed withdrawal messages through the ICON migration contract / SODAX Asset Manager path. A serial-number precision defect meant the uniqueness check and signature verification did not validate the same exact value, allowing 1,490 successful repeated calls and unauthorized release of foundation-held assets. The withdrawal path was paused and ICON Network was temporarily halted before a corrected contract and additional relayer control were deployed.

The Sandbox published its compensation process for users affected by the August exploit, stating that it had committed to a full compensation plan and explaining eligibility and claim mechanics.

Axelar governance Proposal #490 passed as an explicitly non-binding signaling proposal supporting a future process to freeze identified hacker funds and later recustody them to a trusted distributor for affected users.

Verus v1.2.17 described a deterministic restoration process for affected holdings and restitution credits intended to represent reduced vETH and tBTC.vETH value. The reviewed source supports restitution in progress but does not prove completion for every affected user.

Taiko states that the Foundation and Taiko Labs covered the complete shortfall, restored 1:1 backing, and made every affected user whole without waiting for attacker-fund recovery.

Everclear announced the wind-down of Foundation, Labs, and product-development operations after failing to reach sustainable commercial depth.

The official shutdown page states that every SYND balance on Commons, including staked SYND and unclaimed rewards, was returned to the corresponding Base wallet plus an additional 15 percent.