ChainConnect 2026 Alien Proxy callback exploit

Timeline events

• ChainConnect callback flaw exploited and bridge operations paused2026-07-26

  Venom and ChainConnect reported an application-level ChainConnect incident involving missing sender verification in an Alien Proxy callback. The incident enabled unauthorized unbacked token minting and movement through the standard bridge flow; ChainConnect paused bridge operations while investigating. BIR does not classify this as a Venom network, relay, validator-key, or privileged-key compromise.

  Exploit OccurredHigh

  Safe high-level description only; no exploit reproduction detail is included.

• ChainConnect records partial fund return and whitehat bounty settlement2026-07-31

  ChainConnect-authored recovery messaging recorded a 280 ETH return transaction on July 31. Venom later summarized the recovery as 82.9% of affected funds, approximately USD 615,000, returned with 17.1% retained as a whitehat bounty. This is attacker-fund recovery and bounty evidence, not proof of completed user reimbursement or bridge reopening.

  Funds ReturnedHigh

  The return valuation, return ratio, bounty share, and 280 ETH transaction are retained as separate supported observations rather than collapsed into one inferred gross-loss calculation.

Evidence records

• ChainConnect Security Incident
  ChainConnect · Tier 1 · High reliability · primary · 2026-07
  Claim scope: Incident Case

  First-party ChainConnect incident notice supporting the EVM integration breach, bridge-contract liquidity drain, bridge pause, and statement that connected wallets/accounts were not compromised.

• ChainConnect security incident update
  Venom Foundation · Tier 1 · High reliability · primary · 2026-07-28
  Claim scope: Incident Case

  Affected-ecosystem first-party update supporting temporary suspension of ChainConnect bridge operations and separating the incident from compromise of the Venom network.

• Post-mortem: ChainConnect security incident
  Venom Foundation · Tier 1 · High reliability · primary · 2026-08-01
  Claim scope: Recovery

  First-party ecosystem post-mortem summary supporting the July 26 incident date, missing sender verification in the Alien Proxy callback, scope exclusions, patch, 82.9% (~USD 615k) return, and 17.1% bounty.

• ChainConnect incident post-mortem
  ChainConnect · Tier 1 · High reliability · primary · 2026-08
  Claim scope: Event

  Direct first-party ChainConnect post-mortem URL referenced by Venom. Publication precision remains conservative because the reviewed public rendering did not independently expose a stable exact day.

• ChainConnect recovery messages and return tracking
  Defimon · Tier 2 · High reliability · secondary · 2026-07-31
  Claim scope: Recovery

  Independent on-chain monitoring preserving ChainConnect-authored whitehat negotiation and return messages, including identification of the July 31 return transaction.

• ChainConnect 280 ETH return transaction
  Etherscan · Tier 2 · High reliability · secondary · 2026-07-31
  Claim scope: Recovery

  Transaction reference identified by ChainConnect-authored recovery messaging as the 280 ETH return. BIR does not infer a full gross-loss amount from this transaction.

• ChainConnect bridge incident entry
  SlowMist · Tier 2 · High reliability · secondary · 2026-07
  Claim scope: Amount

  Secondary security-database entry supporting an approximately USD 650k incident estimate. The figure remains a claim and is not promoted to canonical reported_loss_usd because first-party recovery valuation uses a different scope.

Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.