Asterix (2026) — Crypto Hack
Funds LaunderedCross-chain bridge message forgery drained $10M across Ethereum and Arbitrum
Summary
Cross-chain bridge message forgery drained $10M across Ethereum and Arbitrum
How It Was Compromised — Bridge Exploit via Cross-chain message verification bypass. Attacker forged bridge messages between Ethereum and Arbitrum, minting unbacked tokens on Arbitrum and withdrawing real assets on Ethereum.
On June 7, 2026, Asterix bridge between Ethereum and Arbitrum was exploited for $10 million. The attacker discovered a vulnerability in the cross-chain message verification system that allowed them to forge bridge messages. By creating fake deposit proofs on Ethereum, the attacker minted unbacked tokens on Arbitrum, which were then sold or used as collateral. Simultaneously, the attacker withdrew real assets from the Ethereum side using manipulated withdrawal proofs. The exploit went undetected for several hours due to insufficient monitoring.
Fund Flow & Laundering Analysis
ARB tokens were sold through decentralized exchanges and bridged to Ethereum. ETH was consolidated and deposited into Tornado Cash. The attacker used multiple intermediate wallets and cross-chain bridges to fragment the trail. A portion of funds was sent to privacy-focused Layer 2 solutions. The complexity of cross-chain movements has made tracing difficult.