Chiliz CEO: The loss from the security incident is approximately 1 ETH, and user funds were not affected

Chiliz, the sports fan token platform, CEO Alexandre Dreyfus released a security update stating that user funds and wallets were unaffected. The total loss from the incident was approximately 1 ETH, about 2000 USD, coming from wallets used to pay cross-chain bridge fees, with no additional fund losses reported.

Dreyfus stated that on October 26, the team discovered that attackers accessed part of the internal infrastructure through an outdated legacy partner website. The company has been continuously investigating with an independent forensic agency. It confirmed that the company's multi-signature was not breached at the code and key levels, the core smart contracts and treasury code were not tampered with, and the digital asset treasury as well as the minting of CHZ and fan tokens were unaffected. Approximately 1 ETH was withdrawn from 7 hot wallets used to pay cross-chain bridge fees, and the relevant transactions can be publicly queried on Etherscan.

Dreyfus also mentioned that the attackers had accessed a cryptocurrency user database, but there is currently no evidence to suggest that data was exported, nor is there evidence that passwords or KYC documents were exposed. The company has notified regulatory authorities in accordance with GDPR and the requirements related to the Malta Financial Services Authority and MiCA, and has rotated all keys and credentials, suspended the cross-chain bridge, and revoked all relays, while transferring the cross-chain bridge wallets to institutional custody. The governance portal has been suspended as a precautionary measure. Users are reminded not to share passkeys or recovery toolkits and to only use official channels.