Anyswap Multichain Router V3 hack — July 2021

Anyswap's newly launched Multichain Router V3 was drained on 10 July 2021 at about 20:00 UTC. According to the team's own exploit statement, roughly $7.9 million left the V3 cross-chain liquidity pools: 5,509,222.73 MIM and 2,398,496.02 USDC, across Ethereum, BNB Chain and Fantom.

The root cause was a cryptographic implementation error rather than a smart-contract flaw. The V3 router's MPC account signed two transactions on BNB Chain that reused the same ECDSA nonce, producing signatures with an identical R value. When two signatures from one key share an R value, the private key can be recovered algebraically from data that is already public on the chain. This failure mode has been documented since at least 2010, when the group fail0verflow demonstrated it against Sony's PlayStation 3 signing key. Whoever noticed the repeated R value derived the MPC account's key and used it to move the pooled stablecoins.

Anyswap said only the new V3 cross-chain liquidity pools were affected and that the bridge continued operating through its V1 and V2 routers. It patched the signing code to prevent identical R values, said it had put remedial measures in place to compensate liquidity providers in full, engaged Trail of Bits for auditing, and relaunched V3 later in July 2021. An analysis published by Wanchain's research team independently reconstructed the nonce-reuse arithmetic from the on-chain signatures.

No perpetrator was identified. This is a separate event from the July 2023 collapse of Multichain, the protocol Anyswap later became, in which much larger sums left the bridge's custody.