ICON–SODAX 2026 withdrawal-message replay exploit
On August 27, 2026, an attacker replayed two previously legitimate signed withdrawal messages through the ICON migration contract / SODAX Asset Manager path. A serial-number precision defect meant the uniqueness check and signature verification did not validate the same exact value, allowing 1,490 successful repeated calls and unauthorized release of foundation-held assets. The withdrawal path was paused and ICON Network was temporarily halted before a corrected contract and additional relayer control were deployed.
Incident facts
- Incident title
- ICON–SODAX 2026 withdrawal-message replay exploit
- Bridge
- ICON–SODAX Migration Bridge
- Incident date
- 2026-08-27
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Unknown, Ethereum
- Affected assets
- Unknown, ETH, USDC
- Attack category
- Message Verification Failure
- Reported loss
- 150.2 ETH + 31,204 USDC confirmed net loss
- Amount confidence
- High
- Loss amount basis
- Official Postmortem; Token Amounts Preserved Without USD Conversion
- Recovery
- Partial Recovery
- Reimbursement
- Unknown
- Restart
- Reopened
- Current outcome
- Active After Incident
- Postmortem
- Full
- Resolution
- Unresolved
- Last reviewed
- 2026-09-04
- Last verified
- 2026-09-04
Amount and valuation
The ICON Foundation postmortem reported confirmed net loss of approximately 150.2 ETH plus 31,204 USDC. The gross 119,866,000 ICX release is not treated as final realized loss because most ICX was traced/frozen at exchanges and recovery remained active.
Preserves the first-party confirmed-net-loss boundary rather than converting gross released ICX into a USD loss estimate.
approximately 150.2 ETH plus 31,204 USDC confirmed net loss
The same postmortem says most exploited ICX was traced/frozen and in active recovery.
Why this remains unresolved
- Exchange-frozen ICX recovery was still active at postmortem publication.
- No reimbursement program or final reimbursement outcome is established in the admitted evidence.
Timeline events
Withdrawal-message replay exploit releases foundation-held assets2026-08-27
Two previously legitimate signed withdrawal messages were replayed 1,492 times; 1,490 calls succeeded, releasing 119,866,000 ICX and 531,600 bnUSD to an attacker-controlled relayer wallet. The postmortem distinguishes gross released assets from later confirmed net loss and states user deposits, balances, and positions were not affected.
Gross released ICX/bnUSD is not treated as final realized loss.
Withdrawal path paused and ICON Network halted for containment2026-08-27
The affected withdrawal path was paused at 03:53 UTC. ICON Network was then halted at 06:18:54 UTC as an additional containment measure, freezing balances on-chain while exchange-side freeze coordination continued.
Bridge-path pause and network-wide halt are distinct containment actions.
Corrected contract deployed and ICON Network resumed2026-08-28
The serialization defect was corrected, authorized-relayer allowlisting was added, and the ICON Network resumed at approximately 07:51 UTC on August 28, 2026. The postmortem reported bnUSD and SODA recovery while exchange-frozen ICX recovery remained active.
Restart does not imply completed recovery.
Evidence records
- ICON Network: Replay Exploit Post-MortemICON Foundation · Tier 1 · High reliability · primary · 2026-08-30Claim scope: Incident Case
Primary first-party postmortem for the replay exploit, root cause, gross released assets, and confirmed net-loss boundary.
- ICON Network: Replay Exploit Post-MortemICON Foundation · Tier 1 · High reliability · primary · 2026-08-30Claim scope: Incident Followup
Primary first-party postmortem for the withdrawal-path pause, ICON network halt, and containment timeline.
- ICON Network: Replay Exploit Post-MortemICON Foundation · Tier 1 · High reliability · primary · 2026-08-30Claim scope: Recovery
Primary first-party postmortem for the corrected contract, August 28 restart, recovered bnUSD/SODA/USDC amounts, and ongoing exchange-frozen ICX recovery.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- Final amount of frozen ICX ultimately recovered after the August 30 postmortem is not established here.
- No canonical ICON or Sonic chain-reference key exists in this batch.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.