IoTeX offers a 10% bounty reward for recovery: Hackers will not be held accountable if they return the stolen assets within 48 hours.

On February 24, IoTeX announced that in response to the hacking incident involving its cross-chain bridge ioTube, a 10% white-hat bounty (approximately $440,000) was offered to the attacker on the condition that they return about $4.4 million in stolen assets within 48 hours, and that no legal action would be pursued. The attack occurred on February 21 and was caused by the leakage of the validator private key on the Ethereum side of ioTube, leading to unauthorized control of the bridge contract. IoTeX stated that this incident pertains to security issues at the cross-chain bridge operational layer and did not affect its Layer 1 mainnet or smart contracts themselves. IoTeX co-founder and CEO Raullen Chai said that the team has issued a non-accusatory statement to the attacker through on-chain information and has tracked the flow of related funds, including approximately 66.6 BTC (about $4.3 million) stored in multiple Bitcoin addresses. Additionally, the associated deposit addresses on relevant exchanges have been marked and frozen. Security firm PeckShield estimates that the assets involved in this incident exceed $8 million, with some assets exchanged for ETH and bridged to BTC via THORChain. IoTeX later revised the loss estimate to approximately $4.3 million, noting that this figure does not include additional minted tokens. IoTeX also announced the upcoming release of mainnet upgrade version v2.3.4, which will introduce a default blacklist mechanism for malicious addresses, and urged node operators to complete the upgrade promptly. The team stated that if assets are not recovered, they will disclose a compensation plan within 48 hours.