ChainBleedv0.1 · open intel
← back to feed·ETHBRIDGE2026-05-16 · 1mo ago
Incident · CHAINBLEED

Adshares

Bridge-Minter Fake-Mint Exploit (wADS)
Estimated loss
$628.0K
VERDICT —AMBIGUOUS
Vector is partially known — fake mint via bridge-minter signature on non-existent source-chain txids — but the upstream cause (key compromise, signer software bug, or insider) is not disclosed. If a single EOA can authorize mints with no on-chain proof of the source-chain deposit, that is an architectural / configuration-layer trust assumption a pre-deployment review should flag; if the minter key itself was compromised via off-chain means, the on-chain contract behaved as designed and the root cause sits outside any contract review. Verdict will be re-evaluated when Adshares publishes a post-mortem.
▰ METHOD
Fake wrapTo() mints referencing non-existent source-chain txids
BRIDGEBRIDGEBYTECODE CATCHABLE
Root cause

The Adshares cross-chain bridge mints wADS on Ethereum when a privileged minter EOA submits a signed wrapTo() call referencing a deposit on the Adshares native chain. The Ethereum-side bridge contract trusts the minter's signature as the sole authorization for mint — it does not independently verify the existence of the referenced native-chain txid (no light-client proof, no Merkle inclusion check, no multi-signer quorum on the EVM side). Three wrapTo() calls were submitted with txids that do not exist on the Adshares native chain; the contract accepted the signatures and minted wADS to the attacker. Upstream cause — whether the minter private key was compromised, or the minter operator software was tricked, or this is an insider action — is not yet disclosed.

Forensic narrative

Adshares (@adsharesNet) lost approximately $628K when the cross-chain bridge minted wADS on Ethereum against three native-chain deposits that did not exist. The bridge-minter EOA signed three wrapTo() calls referencing non-existent Adshares-chain txids; the Ethereum bridge contract — which trusts the minter signature as authoritative rather than verifying the source-chain txid on-chain — accepted them and minted fresh wADS to the attacker. The attacker immediately dumped the wADS into Ethereum DEX liquidity for ~148.5 ETH and ~$305K USDC, consolidating into wallet 0x63e22ce9bde9bb8892a447258abfcaa4142f001b, which at time of intake held 286.95 ETH (~$625,601 at $2,180.15/ETH) plus dust token balances. Whether the minter key was compromised, the operator's signing software was bug-tricked, or an insider used legitimate access remains undisclosed pending post-mortem.

Primary source
https://etherscan.io/address/0x63e22ce9bde9bb8892a447258abfcaa4142f001b
Sourced from
chainbleed
Technical record
chain
ethereum
protocol
Adshares
bug_class
bridge
date_occurred
2026-05-16
loss_usd
$628,000
classification
Bridge — Mint Validation
technique
Fake wrapTo() mints referencing non-existent source-chain txids
target_type
Cross-chain bridge
bridge_hack
YES
source_id
cb:adshares-bridge-mint-2026-05-16
Related — same bug class· bridge
2026-05-15
1mo ago
MULTI
THORChain
Cross-Chain Router Exploit (multi-chain drain)
bridge
$10.70M
AMBIGUOUS
2026-04-29
1mo ago
BASE
Syndicate
Commons Bridge Exploit
bridge
$380.0K
UNRATED
2026-04-29
1mo ago
MULTI
Syndicate
Exploit
bridge
$330.0K
UNRATED
2026-04-27
1mo ago
MULTI
ZetaChain
GatewayEVM Contracts Exploit
bridge
$300.0K
UNRATED
2026-04-18
1mo ago
MULTI
Kelp
LayerZero OFT bridge exploit
bridge
$293.00M
CONFIG LAYER
2026-04-12
2mo ago
MULTI
Hyperbridge
Fake State Proof
bridge
$2.50M
UNRATED
ChainBleed — live web3 threat intelligence