A private key compromise gave an attacker unauthorized access to IoTeX's token safe on Feb. 21, draining assets worth an estimated $8 million or more before funds were converted to Ethereum and routed to Bitcoin (BTC) via THORChain.
The IoTeX team confirmed the breach but contested the damage figures circulating in the market, saying actual losses are lower than reported.
IOTX, IoTeX's native token, fell roughly 9–10% on the news, with trading volume surging over 500% within 24 hours.
What Happened
Blockchain security firm PeckShield confirmed the exploit on X, stating the hacker gained full control of the token safe through a compromised private key and extracted multiple assets including USDC, USDT, IOTX, WBTC, PAYG, and BUSD.
The attacker then swapped the stolen tokens for ETH and bridged approximately 45 ETH to Bitcoin addresses using THORChain - a cross-chain routing protocol with no centralized freeze mechanism.
Beyond the initial drain, the attacker allegedly exploited the same compromised access to mint 111 million CIOTX tokens, pushing total estimated damage toward $8.8 million to $9 million across all vectors. Three attacker wallet addresses have been publicly identified by on-chain analysts.
IoTeX's Response
IoTeX acknowledged the breach publicly by approximately 10:30 AM UTC on Feb. 21.
The team said it had coordinated with major cryptocurrency exchanges and security partners to trace and freeze the hacker's assets where possible, and described the situation as "under control."
The project did not disclose a confirmed loss figure, saying only that initial estimates are "significantly lower than circulating rumors."
Read also: Italian Tax Police Crack €500K Crypto Evasion Ring - Blockchain Was The Witness
Why It Matters
Recovery prospects are complicated by the attacker's use of THORChain, which processes cross-chain swaps without custodians and cannot be frozen by centralized parties. Once funds reach Bitcoin addresses via that route, on-chain traceability narrows considerably.
The IoTeX breach is part of a wider pattern. CrossCurve lost $3 million in a separate bridge exploit just three weeks prior, and January 2026 saw nearly $400 million in total cryptocurrency theft industry-wide, according to available security tracking data.
Private key compromises - rather than smart contract bugs - are increasingly the attack vector of choice, bypassing audited code entirely by targeting operational security.
Read also: Ripple CEO Puts 90% Odds On Crypto's Most Consequential U.S. Bill Passing By April