According to the ICON Foundation, the Aug. 27 ICON replay exploit released 119,866,000 ICX and 531,600 bnUSD from foundation-held assets after two legitimate withdrawal messages were reused 1,492 times. Its Aug. 30 postmortem said 1,490 calls succeeded, while no user deposits, balances or positions were accessed.
The headline-sized ICX release is not the same as the confirmed loss. ICON put net loss to date at about 150.2 ETH plus 31,204 USDC, with the vast majority of the ICX traced, frozen and in active recovery. The foundation said bnUSD and SODA were recovered in full, but exchange-held amounts remain subject to revision. That distinction matters because ICON had not received exact exchange figures for how much ICX was held, converted or withdrawn.
The flaw let the attacker change part of a withdrawal identifier without changing the signed payload being verified. ICON traced the mismatch to a change intended to standardize withdrawal messages at 32 bytes, which routed part of the serial number through float64-range logic rather than exact integer arithmetic.
As a result, the contract’s uniqueness check looked at high bits the attacker could vary, while cryptographic verification covered the unchanged low 256 bits. The signed payload and signature remained identical within each replay set, but the altered unsigned portion made the calls appear unique. Two calls reverted; every successful call credited the same relayer wallet. ICON said the flaw was specific to its implementation because other supported chains used fixed-width integers that could not produce the same mismatch.
Detection of the ICON replay exploit came before containment
ICON’s monitoring system fired at 02:08 UTC, seven minutes after the exploit began. Technical staff started investigating at about 03:40, a 92-minute gap. The affected contract was paused at 03:53, 105 minutes after the alert.
The attacker had begun splitting ICX across exchange deposit addresses at 02:44, according to ICON, and the distribution continued until about 05:20. The foundation said an ICON-side pause could not stop movement of funds already swept into exchange custody.
The network was halted at 06:18:54 and resumed at about 07:51 the next day, roughly 25 hours later. Public notices from Bitvavo, Bitget and KuCoin confirm that ICX deposits and withdrawals were suspended around the incident, though none identifies itself as holding attacker funds or verifies the amount frozen.
A November 2025 relay audit reviewed selected relay and verifier code, including ICON verifier files, but its published scope did not list the affected migration-contract source. None of its nine disclosed findings flagged the serial-number mismatch. ICON said incident-related relay logic had been audited, but that the gap fell outside the findings.
