ICON network suffers replay attack releasing 119 million ICX

The ICON Foundation reported a replay attack on its network that occurred on August 27, during which two legitimate withdrawal messages were reused 1,492 times. This resulted in the release of 119,866,000 ICX and 531,600 bnUSD from assets held by the foundation.

According to a postmortem report, the vulnerability stemmed from an error during the standardization of withdrawal messages to a fixed 32-byte size. This caused a mismatch where the integrity check examined the high bits of a serial number while cryptographic signature verification examined the lower 256 bits. This allowed an attacker to alter unsigned portions of a message to make repeated calls appear unique.

The foundation clarified that while a large amount of ICX was released, the confirmed net loss is approximately 150.2 ETH and 31,204 USDC. Most of the released ICX has been traced and frozen on exchanges, and bnUSD and SODA assets were fully recovered. User deposits, balances, and positions were not affected.

In response to the incident, the network was temporarily suspended and later resumed after implementing fixes, including using exact integer arithmetic for serial numbers and adding an allowlist for authorized relayer addresses. Several exchanges, including Bitget and KuCoin, temporarily suspended ICX deposits and withdrawals to facilitate recovery efforts.