ICON–SODAX Migration Bridge
The ICON–SODAX migration bridge is the migration and withdrawal path connecting ICON-held ICX/bnUSD with SODAX-side assets through the ICON migration contract and SODAX Asset Manager. On August 27, 2026, a replay defect in signed withdrawal-message uniqueness handling allowed repeated releases of foundation-held assets. The affected withdrawal path was paused, the ICON Network was temporarily halted, and a corrected contract was deployed before network operation resumed on August 28.
Bridge facts
- Canonical name
- ICON–SODAX Migration Bridge
- Type
- Asset Bridge
- Status
- Active
- Confidence
- High
- Primary chains
- Unknown
- Primary assets
- Unknown
- Operator
- ICON Foundation / SODAX
- Ecosystem
- ICON / SODAX
- Launch date
- Unknown
- End date
- Unknown
- Terminal reason
- Not applicable / unknown
- Last reviewed
- 2026-09-04
- Last verified
- 2026-09-04
Incident cases
ICON–SODAX 2026 withdrawal-message replay exploit2026-08-27
On August 27, 2026, an attacker replayed two previously legitimate signed withdrawal messages through the ICON migration contract / SODAX Asset Manager path. A serial-number precision defect meant the uniqueness check and signature verification did not validate the same exact value, allowing 1,490 successful repeated calls and unauthorized release of foundation-held assets. The withdrawal path was paused and ICON Network was temporarily halted before a corrected contract and additional relayer control were deployed.
Evidence records
- ICON Network: Replay Exploit Post-MortemICON Foundation · Tier 1 · 2026-08-30
- ICON Network: Replay Exploit Post-MortemICON Foundation · Tier 1 · 2026-08-30
- ICON Network: Replay Exploit Post-MortemICON Foundation · Tier 1 · 2026-08-30
Official URL status
Official URL recorded as live: https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortemHelp maintain bridge history
Support incident linkage, lifecycle updates, evidence preservation, broken-link replacement, and corrections.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.