ChainConnect
ChainConnect is a multi-chain EVM↔TVM asset bridge. A July 2026 incident exploited missing sender verification in an Alien Proxy callback, enabling unbacked Alien TIP-3 minting and transfer through the bridge flow to Ethereum. ChainConnect paused bridge operations and patched affected deployments; a dated post-incident reopening has not been established in the reviewed first-party record.
Bridge facts
- Canonical name
- ChainConnect
- Type
- Asset Bridge
- Status
- Paused
- Confidence
- High
- Primary chains
- Venom, Ethereum
- Primary assets
- Unknown
- Operator
- ChainConnect
- Ecosystem
- Venom
- Launch date
- Unknown
- End date
- Unknown
- Terminal reason
- Not applicable / unknown
- Last reviewed
- 2026-08-19
- Last verified
- 2026-08-19
Incident cases
ChainConnect 2026 Alien Proxy callback exploit2026-07-26
On July 26, 2026, missing sender verification in a ChainConnect Alien Proxy callback enabled unbacked Alien TIP-3 minting and bridging to Ethereum. ChainConnect paused and patched affected deployments. Venom later reported 82.9% (~USD 615,000) returned and 17.1% retained as a whitehat bounty; post-incident reopening remains unverified.
Evidence records
- ChainConnect Security IncidentChainConnect · Tier 1 · 2026-07
- ChainConnect security incident updateVenom Foundation · Tier 1 · 2026-07-28
- Post-mortem: ChainConnect security incidentVenom Foundation · Tier 1 · 2026-08-01
- ChainConnect incident post-mortemChainConnect · Tier 1 · 2026-08
- ChainConnect bridge architectureChainConnect · Tier 1 · Approx. 2026-08-19
- ChainConnect recovery messages and return trackingDefimon · Tier 2 · 2026-07-31
- ChainConnect 280 ETH return transactionEtherscan · Tier 2 · 2026-07-31
- ChainConnect bridge incident entrySlowMist · Tier 2 · 2026-07
Official URL status
Official URL recorded as live_verified: https://app.chainconnect.com/Help maintain bridge history
Support incident linkage, lifecycle updates, evidence preservation, broken-link replacement, and corrections.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.