cross-chain

The cross-chain liquidity protocol Symbiosis announced that it has encountered a security incident. Around September 11, 2026, at 04:28 UTC, attackers exploited a vulnerability in the Bitcoin bridge to carry out the attack. The BTC route has been suspended, while other routes are still operating normally.The official statement indicated that only the Bitcoin bridge was affected and has been isolated from other systems. The remaining routes, including EVM chains, TRON, TON, and components like Octopools, were not impacted. The team has recovered approximately 15 BTC, which is stored in a multi-signature wallet controlled by the team. The official has offered a white hat bounty to the attackers, amounting to 20% of the funds, valid until September 13, 2026; thereafter, an equivalent proportion will be offered to informants who can assist in recovering the funds.The final loss assessment is still ongoing, and confirmation data will be released later. The official is contacting affected liquidity providers one by one and developing a compensation framework. The relay group is still operational and ensuring network security.

Osmosis posted on platform X that due to a security incident with the Nomic nBTC cross-chain bridge, Osmosis has suspended the minting and redemption of BTC Alloyed assets, and deposits and withdrawals have been simultaneously suspended.The BTC on Osmosis is backed by 30% nBTC. The team will soon release a complete post-mortem analysis and recovery plan. BTC in the pool is still tradable, and users are reminded to be aware of the risks.

According to on-chain analysts' monitoring, four addresses belonging to the same entity became active simultaneously after being dormant for six months, purchasing 13,290.6 ETH through Cowswap at an average price of $2,511, and spending 2,500 ETH via Near Intents to buy 6,601.37 ZEC.At the same time, a service fee of 16.75 ETH was paid, approximately $42,000, and the related purchases are still ongoing.

LayerZero announced that the South Korean digital asset custody institution BDACS has adopted LayerZero Labs' OFT (Omnichain Fungible Token) standard for the Korean won-backed stablecoin KRW1, achieving native cross-chain interoperability.LayerZero stated that KRW1 thus becomes the first Korean won stablecoin that can be natively transferred across major DeFi ecosystems, with its supply able to flow seamlessly across networks without the need for wrapped tokens, avoiding liquidity fragmentation.

According to Token Terminal data, the scale of ETH transferred from Ethereum L1 to Robinhood Chain L2 has exceeded 700 million dollars, growing by approximately 150% in the past month.

The Federal Bureau of Investigation (FBI) tracked and seized over $560,000 in cryptocurrency originally intended for Hamas by combining blockchain analysis, human intelligence, and court orders. The investigation involved shared wallets, cross-chain bridges, exchanges, and stablecoin accounts. Three seizure operations occurred in March, June, and October 2025.Investigators found that multiple donation addresses associated with Hamas's military wing, Al Qassam Brigades, used the same Gas wallet to pay transaction fees, and visualized funds flowing from donation wallets to operational wallets and related infrastructure through Reactor. In the June 2025 case, funds circulated through new addresses, accounts, over-the-counter brokers, and suspected money mule accounts; in October, the network switched to one-time donation wallets and cross-chain bridges. Court orders required Tether to destroy USDT from specified addresses and to reissue equivalent assets to law enforcement wallets, while Binance was instructed to transfer the balances of three accounts.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

Router Protocol, a cross-chain infrastructure project supported by Coinbase Ventures, announced that it will cease all operations by September 30 and plans to permanently destroy 303,333,198 ROUTE tokens held in its treasury, accounting for about 30% of the total supply of nearly 1 billion tokens. The team released a statement on X, stating that over the past year, they attempted commercialization, licensing, and acquisition negotiations, but failed to achieve sustainable operational results.Router identified the flow of funds from the cryptocurrency sector to artificial intelligence and the decline in cross-chain asset transfer fees as core challenges facing its operations. As activities concentrated on fewer networks and standardized infrastructure, the demand for its services has decreased. The team noted that bridging economic profits are thin, fees have been compressed, and costs have never stopped. As part of the closure, Router will negotiate with centralized exchanges to stop supporting ROUTE tokens, and the delisting arrangements and withdrawal processes may vary across exchanges.Router raised $4.1 million from investors including Coinbase Ventures and Polygon in 2021 and launched the proof-of-stake Layer 1 blockchain Router Chain in July 2024, but it was shut down in September 2025 due to infrastructure costs, validator expansion, and security risks. The team also disclosed two security incidents in 2025: in February, approximately 80% of the value was recovered through negotiations after a vulnerability incident, while losses from a chain-level vulnerability in July could not be recovered.

ARK Invest's Director of Digital Asset Research, Lorenzo Valente, posted on X that since the rise of L1, application chains, and Rollup-centric roadmaps, messaging and interoperability protocols have become critical infrastructure. As more assets go on-chain, the demand for universal interoperability will grow exponentially.Lorenzo Valente stated that the interoperability business of the cross-chain interoperability protocol LayerZero is likely to quickly grow to a nine-figure ARR, and mentioned that the team has more progress to share in the future.

The cross-chain protocol Router Protocol announced that after more than four years of development, it has decided to gradually cease operations and will fully shut down before September 30, 2026. The team stated that over the past two years, Web3 liquidity has remained scarce, the market focus has shifted to AI, the enthusiasm for cross-chain interoperability has waned, and the revenue from bridging services has been insufficient to cover costs. Although various paths such as commercialization, licensing, and acquisitions were attempted in the past year, no sustainable solution was achieved. Router Protocol will permanently destroy 303,333,198 ROUTE tokens pending in the treasury and will coordinate with centralized exchanges to delist ROUTE. Holders need to withdraw their tokens according to the arrangements of each exchange before the deadline. In addition, the project will not launch any new plans related to ROUTE and plans to open-source some technical components for community use.

Users can send supported tokens from networks such as Ethereum, Base, Arbitrum, and Sui to Jupiter without using bridging tools and directly receive USDC in their Solana wallet. This feature integrates routing, cross-chain bridging, and exchange processes, allowing users to avoid switching networks or executing additional transactions.Currently, the service adopts a uniform fixed fee rate, charging $0.30 per transaction, regardless of whether the transfer amount is $100 or $10 million, the fee remains unchanged.

According to a report from Circle's official blog, Circle's cross-chain infrastructure CCTP has officially expanded to support the native cross-chain transfer of the euro stablecoin EURC.EURC adopts the same "burn-mint" model as USDC, with the first phase supporting cross-chain settlement between Ethereum and Base chains. Developers can transfer both USDC and EURC through a unified interface without needing to connect to multiple bridging service providers, effectively reducing integration complexity and enhancing liquidity efficiency. EURC is issued by Circle's regulated subsidiary, and CCTP does not hold or manage user assets.

The privacy public chain Zano activated its sixth hard fork (HF6) at block height 3,833,000. The upgrade has been launched on the mainnet, completing the largest upgrade in the network's seven-year history. HF6 introduces Gateway Addresses, providing a directly traceable single balance and instant synchronization for centralized exchanges, DEX, and cross-chain bridges, while retaining existing addresses and their privacy models.Native ZANO can now be cross-chain transferred to Ethereum, Solana, and TON without custody, publicly on external networks, and privacy protection is restored after crossing back to Zano. The upgrade also tightens consensus validation rules and strengthens wallet encryption, mining pool fault tolerance, payment IDs, anti-DoS restrictions, SOCKS5 proxies, and RPC interfaces. HF6 is a prerequisite for the development of the EVM-compatible chain Zano Execution Layer, which currently has no fixed launch date; the next-generation consensus protocol Zenith has been included in the 2027 roadmap.

According to Decrypt, THORChain announced the launch of version 3.2, which adds native cross-chain exchange support for Monero (XMR) and Zcash (ZEC). Users can directly exchange XMR and ZEC for BTC, ETH, and stablecoins without the need to wrap assets, register centralized exchange accounts, or relinquish asset custody.This upgrade also introduces Protocol Owned Liquidity (POL) and Stable Reserve, and restores support for Solana, Base, and BNB. Among them, Stable Reserve supports zero liquidity fee exchanges between stablecoins. This upgrade is expected to provide a new non-custodial trading path for users facing liquidity channel shrinkage due to centralized exchanges delisting or restricting XMR.

The blockchain network BNB Chain has enabled the Pasteur hard fork on the BNB Smart Chain (BSC) mainnet. The upgrade involves cross-chain bridge validation, validator authorization, staking, and governance security, while enhancing block capacity without changing the 450 milliseconds block time.This upgrade includes BEP-682, BEP-695, and BEP-675, which respectively involve duplicate validator entries, validator key rotation and penalty governance, and block submission processes. In the internal testing environment QANet, the new process increased throughput from 1,237 transactions per second to 2,324 transactions per second, but the related data comes from controlled tests and not mainnet measurement results.

The Slow Mist security team disclosed that the cross-chain bridge project Allbridge was attacked on August 19, 2026, resulting in a loss of approximately $190,000. Notably, this attack was not executed instantly; the attacker had begun laying the groundwork nearly a month prior and bypassed the verification mechanism by forging cross-chain messages. According to Slow Mist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as a CCTP style message, claiming that a transfer of 1 million USDC existed, but in reality, no USDC destruction operation took place. Subsequently, Circle generated a valid verification proof (attestation) for this complete message according to normal procedures.About 24 days later, on August 19, the attacker waited for the Base Router to receive a real CCTP deposit, increasing the balance to approximately 191,000 USDC, and initiated the attack just 6 seconds later. The attacker utilized the previously forged message and verification proof to call Allbridge's receiveCctpMessage function. Due to the project's lack of critical verification, the system mistakenly recognized the false cross-chain message as a real deposit and recorded a limit of 1 million USDC. The attacker then temporarily borrowed approximately 809,000 USDC through an Aave flash loan, matching the Router balance with the forged amount, and used the internal credit record to call the transfer function, ultimately transferring out approximately 999,000 USDC (after a 0.1% fee). After repaying the flash loan and fees, the attacker netted a profit of about $189,800. The root cause of this vulnerability lies in Allbridge's failure to verify the identities of the sender and receiver of the cross-chain message, as well as not confirming whether USDC was genuinely minted and whether the balance actually increased, instead directly trusting the amounts and message hash data constructed by the attacker. Slow Mist emphasizes that on-chain message verification does not equate to the actual arrival of real assets. Cross-chain protocols not only need to verify the authenticity of messages but must also ensure that the message source is trustworthy, that the receiver is Circle's official TokenMessengerV2, and that asset accounting can only proceed after confirming the actual minting of assets and changes in balance. This incident once again highlights the security risks of cross-chain bridges in the message verification and asset settlement processes.

The metaverse gaming platform The Sandbox confirmed that there is a vulnerability in its cross-chain bridge, allowing attackers to mint uncollateralized SAND on Base and BNB Smart Chain. Blockchain security company PeckShield discovered on August 21 that two addresses had collectively minted approximately 1.49 billion SAND, prompting The Sandbox to shut down the bridging functions for both networks.The Sandbox stated that the affected assets are those bridged on Base and BNB Smart Chain, while SAND on Ethereum and Polygon, user wallet assets, and Ethereum locked assets used to support the tokens remain unaffected. The incident involved a proportion of real collateralized assets that is less than 0.01% of the total supply of SAND. The Sandbox is formulating a compensation plan for the affected liquidity providers and advises users not to trade SAND on Base or BNB Smart Chain until the bridging function is restored.Coinbase plans to delist 10 perpetual futures contracts, including SAND, on August 26, at which time any open positions will be automatically settled.

The Sandbox official stated that the team has confirmed and fully controlled the recent SAND cross-chain bridge vulnerability incident, involving the Base and BNB Smart Chain (BSC) networks.The official said that the impact of this incident is limited, involving less than 0.01% of the total supply of SAND tokens. SAND on Ethereum and Polygon is unaffected, and user wallets have not been compromised; related token holders and liquidity providers do not need to take action.According to disclosures, the attacker minted uncollateralized SAND tokens on the Base and BSC networks through the vulnerability. Currently, The Sandbox has disabled the SAND cross-chain functionality on both networks, and SAND on Base and BSC has been isolated, temporarily unable to be transferred or exchanged.The Sandbox reminds users not to buy, sell, or trade SAND on the Base and BSC networks, as liquidity on these networks has been affected.The team stated that they have completed a snapshot before the incident and are formulating a compensation plan for affected liquidity pool (LP) users, while continuing to investigate the scope of the vulnerability's impact. A complete incident report and technical review will be released subsequently.

According to crypto journalist Kate Irwin, an abnormal asset outflow event occurred on GalaChain this Tuesday, with 1.99 billion GALA (approximately $2.9 million) and other tokens transferred from five main addresses to a new wallet, and GALA was cross-chain exchanged for ETH within about an hour. Approximately 82% (1.639 billion GALA) came from a wallet associated with Gala CEO and co-founder Eric Schiermeyer, which also saw an outflow of about $500,000 in other tokens.Hours after the incident, Gala developers submitted a fix on GitHub, characterizing it as a GalaChain EIP-712 unsigned field injection vulnerability. Currently, Gala has suspended the Ethereum and Solana cross-chain bridge, with officials stating "under maintenance," and GalaChain and its CEO have not yet responded to requests for comment.