How much was lost in the Multichain hack?

$126M Bridge Collapse, as publicly reported (July 6, 2023).

Who was behind the Multichain hack?

Publicly attributed to Insider (CEO arrested). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Multichain

Multichain Hack: $126M Bridge Collapse

Q: How was the Multichain hack carried out?

CEO Arrested — Keys Seized. In May 2023, Multichain CEO Zhaojun He was detained by Chinese police. Critically, He had sole control of all MPC server infrastructure — private keys to bridge reserves across all supported chains. No other team member could operate the protocol.

July 6, 2023 · Fantom / Ethereum / Moonriver · Insider (CEO arrested)

drained

$126M

peak TVL

$1.5B

chains hit

recovered

What happened

On July 6, 2023, Multichain — one of the largest cross-chain bridge protocols with over $1.5B TVL at peak — experienced abnormal outflows of $126M across Fantom, Moonriver, and Dogecoin chains. What initially appeared to be a hack was later revealed to be far more disturbing: Multichain's CEO, Zhaojun He, had been arrested by Chinese authorities in May 2023, taking sole custody of all MPC (multi-party computation) server keys. His sister and other team members subsequently moved funds in an attempt to recover them — actions that appeared indistinguishable from a rug pull to the outside world. The Multichain protocol was officially shut down in July 2023.

How the funds moved

Step 1

CEO Arrested — Keys Seized

In May 2023, Multichain CEO Zhaojun He was detained by Chinese police. Critically, He had sole control of all MPC server infrastructure — private keys to bridge reserves across all supported chains. No other team member could operate the protocol.

Step 2

Abnormal Outflows Begin

On July 6-7, 2023, $126M moved out of Multichain bridge contracts: $102M from Fantom, $13.6M from Moonriver, $666K from Dogecoin bridge. Transactions signed from MPC servers — either by He under duress, his sister attempting recovery, or Chinese authorities.

Step 3

Protocol Shutdown

Multichain team announced they had no access to the MPC servers and could not operate the protocol. Users were advised to revoke approvals immediately. The protocol was officially shut down. $126M remains unrecovered. Several centralized stablecoins (USDC, USDT) on Fantom became unbacked.

Key findings

Root Cause

Single point of failure — CEO held all MPC keysDespite marketing as decentralized MPC infrastructure, all server keys were under sole custody of the CEO. This violated the core security assumption of multi-party computation.

Centralization RiskInsider

Largest Drain

Fantom — $102M in single outflowFantom ecosystem severely impacted. Multichain-bridged assets (anyUSDC, anyUSDT, anyDAI) became effectively unbacked. Fantom Foundation moved $1.9M of its own exposed assets proactively.

Fantom

Legal Context

CEO detained by Chinese authoritiesZhaojun He arrested in May 2023. Sister (also a team member) arrested shortly after. Exact nature of the July outflows — coerced, voluntary, or state-directed — remains unclear.

Aftermath

Protocol shut down — $126M unrecoveredMultichain officially ceased operations July 2023. No restitution plan. Fantom bridged assets lost backing. This marked the effective collapse of the second-largest bridge by TVL.

Protocol Dead

Investigate your own incident

ChainHint traced the Multichain hack in minutes.
Use the same tool for your case.