How much was lost in the Multichain hack?

$126M Bridge Collapse, as publicly reported (July 6, 2023).

Who was behind the Multichain hack?

Publicly attributed to Not established (CEO detained in China). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Multichain

Multichain Hack: $126M Bridge Collapse

Q: How was the Multichain hack carried out?

CEO Detained — Servers Out of Reach. In May 2023 Multichain's CEO was detained by Chinese police, according to Multichain. The company said he alone had access to the MPC server infrastructure holding the bridge's keys, so no other team member could operate the protocol.

July 6, 2023 · Fantom / Ethereum / Moonriver · Not established (CEO detained in China)

drained

$126M

peak TVL

$1.5B

chains hit

recovered

What happened

On July 6–7, 2023, about $126M left the bridge contracts of Multichain — one of the largest cross-chain bridges, over $1.5B TVL at peak — on Fantom, Moonriver and Dogecoin. On 14 July 2023 Multichain said its CEO had been detained by Chinese police in May and was still in custody, that police had taken his computers, phones and hardware wallets, and that the team had lost access to the MPC servers that controlled the bridge. Multichain also said a family member of the CEO had moved about $220M of the remaining assets to wallets under her control for safekeeping and was taken into custody on July 13 (The Block, 14 July 2023). No charges against either have been publicly reported, and who authorised the July outflows has not been established. Multichain ceased operations on 14 July 2023. In July 2024 Singapore's High Court found the Multichain companies liable to the Fantom Foundation for $2.2M, accepting that the CEO's sole control over the bridge breached its user agreement (DL News, 17 July 2024).

How the funds moved

Step 1

CEO Detained — Servers Out of Reach

In May 2023 Multichain's CEO was detained by Chinese police, according to Multichain. The company said he alone had access to the MPC server infrastructure holding the bridge's keys, so no other team member could operate the protocol.

Step 2

Abnormal Outflows Begin

On July 6-7, 2023, $126M moved out of Multichain bridge contracts: $102M from Fantom, $13.6M from Moonriver, $666K from the Dogecoin bridge. Multichain said the movements came from its MPC servers; who authorised them has not been publicly established.

Step 3

Protocol Shutdown

Multichain team announced they had no access to the MPC servers and could not operate the protocol. Users were advised to revoke approvals immediately. The protocol was officially shut down. $126M remains unrecovered. Several centralized stablecoins (USDC, USDT) on Fantom became unbacked.

Key findings

Root Cause

Single point of failure — CEO held all MPC keysDespite marketing as decentralized MPC infrastructure, all server keys were under sole custody of the CEO. This violated the core security assumption of multi-party computation.

Centralization RiskKey custody

Largest Drain

Fantom — $102M in single outflowFantom ecosystem severely impacted. Multichain-bridged assets (anyUSDC, anyUSDT, anyDAI) became effectively unbacked. Fantom Foundation moved $1.9M of its own exposed assets proactively.

Fantom

Legal Context

CEO detained in China — no public chargesMultichain said its CEO was detained by Chinese police in May 2023 and a family member in July 2023 (statement of 14 July 2023). No charges or court proceedings against either have been publicly reported as of 3 November 2026. Whether the July outflows were coerced, voluntary or carried out by authorities remains unclear.

Aftermath

Protocol shut down — $126M unrecoveredMultichain officially ceased operations July 2023. No restitution plan. Fantom bridged assets lost backing. This marked the effective collapse of the second-largest bridge by TVL.

Protocol Dead

Investigate your own incident

ChainHint traced the Multichain hack in minutes.
Use the same tool for your case.