Force Bridge hack — June 2025

Force Bridge, the cross-chain bridge operated by Magickbase for the Nervos CKB network, was drained on 2 June 2025. The theft came two days after Magickbase announced on 31 May that the bridge would be sunset by November 2025 because of low user activity and high maintenance costs, and while users were being told to withdraw their assets.

The attacker obtained privileged access to the bridge's contracts and called functions that unlock and release wrapped assets. Halborn describes the root cause as an access-control issue and notes that this class of attack is typically carried out with compromised private keys, but does not establish that keys were compromised here; no investigator has publicly confirmed how the privileges were obtained. Hacken reconstructed a timeline in which attempts began shortly after 01:30 UTC, a test transaction worth about $25 was made at 02:23 UTC, and repeated failed attempts continued over roughly six hours before the full drain at 07:36 UTC on BNB Chain. Cyvers Alerts was first to flag the incident publicly.

The Block, reporting as it happened, itemised 898,300 USDC, 257,800 USDT, 60,400 DAI, 539.09 ETH and 0.79 WBTC and put the total at "over $3 million." Published totals differ. Halborn gives $3.76 million across Ethereum and BSC. Hacken's account, reported by crypto.news, gives about $3.9 million, split roughly $3 million on Ethereum and $800,000 on BNB Chain, including 874 BNB worth about $572,000 at the time; The Defiant also reports about $3.9 million. The assets were swapped and routed through Tornado Cash and FixedFloat.

Magickbase paused the service, said its team was investigating, and never restarted it. The official sunset site sets exit deadlines of 1 January 2026 for Godwoken and 16 January 2026 for Force Bridge. No reimbursement total has been published.