View source for Nervos Network Force Bridge Drained Shortly After Sunset

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/nervosnetworkforcebridgedrainedshortlyaftersunset.php}}
{{Unattributed Sources}}

[[File:Nervosforcebridge.jpg|thumb|Nervos Network Force Bridge Logo/Template]]Force Bridge, a cross-chain protocol on the Nervos Network, was developed to enable interoperability between blockchains like Ethereum and BNB Chain using smart contracts and token wrapping. Initially praised for expanding Nervos’s DeFi and multi-chain ecosystem, Force Bridge faced a dramatic downfall following a $3.76 million exploit just hours after its planned sunset was announced by Magickbase, citing low activity and high costs. The attack exploited admin-level privileges—likely through compromised credentials or insider access—raising serious concerns about operational security and transparency. With no official post-mortem or fund recovery, the incident has fueled community suspicion and highlighted the dangers of centralized control in DeFi infrastructure.<ref name="magickbasetweet1-20125" /><ref name="theblock-20126" /><ref name="cyversaltertweet-20127" /><ref name="magickbasetweet2-20128" /><ref name="extractorweb3tweet-20129" /><ref name="halborn-20130" /><ref name="etherscan1-20131" /><ref name="etherscan2-20132" /><ref name="bscscan1-20133" /><ref name="bscscan2-20134" /><ref name="runningckbtweet-20135" /><ref name="etherscan3-20136" /><ref name="etherscan4-20137" /><ref name="etherscan5-20138" /><ref name="bscscan3-20139" /><ref name="bscscan4-20140" /><ref name="bscscan5-20141" /><ref name="sunsetforcebridge1-20142" /><ref name="sunsetforcebridge2-20143" /><ref name="startwithnervos1-20144" /><ref name="nervoshome-20145" /><ref name="forkastnews-20146" /><ref name="startwithnervos2-20147" /><ref name="cypherhunter-20148" /><ref name="runningckbtweet-20149" /><ref name="neuronmagickbase-20150" /><ref name="github-20151" /><ref name="nervosnetworktwitterx-20152" /><ref name="nervosorg-20153" /><ref name="messariio-20154" /><ref name="cryptotimes-20155" /><ref name="nervosmediakit-20156" /><ref name="nervosnationtwitterx-20157" /><ref name="nervosnetworkreddit-20158" />

== About Force Bridge ==
Force Bridge is a cross-chain protocol developed on the Nervos Network to enable seamless asset transfers and interoperability between otherwise isolated blockchains. By leveraging smart contracts and token wrapping technology, Force Bridge facilitates decentralized finance (DeFi) operations across multiple blockchain ecosystems. It initially launched with support for Ethereum and ERC-20 tokens such as USDT, USDC, and DAI, and aims to expand compatibility to networks like Bitcoin, Cardano, TRON, EOS, and Polkadot, offering broad cross-chain functionality within a unified framework.

Launched on Nervos mainnet in 2021, Force Bridge represents a strategic milestone in Nervos’s roadmap toward creating an interconnected blockchain ecosystem. Nervos positioned the bridge as a foundational piece of its multi-chain infrastructure, alongside other tools like Godwoken and Polyjuice. These components are designed to support "Universal Applications"—decentralized apps that can operate across multiple blockchains without being limited by their native platforms. This architecture allows developers and users to engage in multi-chain transactions securely and efficiently, without compromising on decentralization or usability.

The significance of Force Bridge extends beyond technical functionality; it also reflects Nervos’s broader vision of building a modular, scalable network that supports a global blockchain ecosystem. Backed by major players like China Merchants Bank International and Sequoia China, and integrated with China’s Blockchain-based Services Network (BSN), Nervos has attracted institutional interest. Additionally, Nervos’s collaboration with IOHK on a bridge to Cardano and the launch of a $50 million ecosystem fund further highlight its commitment to fostering cross-chain development and DeFi innovation.
== About Nervos Network ==
The Nervos Network is a modular, multi-layered blockchain ecosystem designed to address some of the most pressing challenges in the blockchain industry, such as scalability, interoperability, and decentralization. Launched in 2019, the Nervos Network mainnet set out to build a connected on-chain ecosystem, utilizing tools like Force Bridge to facilitate interoperability across blockchains.

At its core is the Common Knowledge Base (CKB), a Layer 1 blockchain that provides a secure, permissionless, and decentralized foundation for the network. CKB is built using the Proof-of-Work (PoW) consensus mechanism and leverages the UTXO model, making it compatible with Bitcoin-like architectures. Its primary role is to act as a base layer for securing data, value, and smart contracts, while higher-performance Layer 2 networks handle transaction throughput and user-facing applications.

What sets Nervos apart is its modular design philosophy. Instead of trying to do everything on one chain, Nervos separates concerns across layers. Layer 1 (CKB) focuses on decentralization and security, while Layer 2 solutions, such as Axon and Godwoken, are optimized for scalability and performance. This architecture enables developers to build high-throughput applications on top of a secure base without compromising on decentralization. It also allows for flexible integration with other blockchains, supporting a wide range of cryptographic primitives and standards, which makes Nervos uniquely positioned for cross-chain interoperability.

Nervos is also pioneering in its approach to Bitcoin interoperability. Through protocols like RGB++ and the UTXO Stack, CKB functions as a Bitcoin-isomorphic platform, enabling enhanced programmability and scalability for Bitcoin-based assets without requiring traditional cross-chain bridges. This opens the door for a more robust Bitcoin ecosystem, where decentralized applications can be built with native Bitcoin assets in a secure and scalable manner.

Finally, the Nervos ecosystem is supported by a vibrant community, active development teams, and initiatives like the CKB Eco Fund, which invests in projects that build on and expand the network. With a clear focus on long-term sustainability, Nervos also incorporates utility-driven tokenomics that align incentives for miners, developers, and users. Altogether, Nervos represents a comprehensive blockchain infrastructure built to support the next generation of decentralized applications and digital economies.

== The Reality ==
Prior to this incident, developers had shared a plan to sunset the project by November 2025. Magickbase had announced plans to sunset Force Bridge, citing low user activity and high maintenance costs in a notice published May 31.

"Over the past few years, Force Bridge and Godwoken have played pivotal roles in expanding the Nervos CKB ecosystem — enabling multi-chain asset interoperability, EVM compatibility, and DApp development. These two products marked Nervos' first major steps toward a layered architecture and cross-chain infrastructure.

However, as the industry evolves and the ecosystem pivots toward UTXO-native capabilities, off-chain services, and value-centric automation, it's time to sunset these early-stage components to make way for the next era of Nervos."

== What Happened ==
Force Bridge, a cross-chain protocol on the Nervos Network, was compromised in a suspected DeFi exploit, resulting in over $3 million in stolen crypto assets.
{| class="wikitable"
|+Key Event Timeline - Nervos Network Force Bridge Drained Shortly After Sunset
!Date
!Event
!Description
|-
|October 14th, 2021 2:36:00 AM MDT
|Force Bridge Launched
|The Force Bridge on the Nervos Network is launched.
|-
|May 31st, 2025 11:50:00 AM MDT
|Sunset Period Announced
|A public tweet by Magick announces the sunset of the Force Bridge and Godwoken projects.
|-
|May 31st, 2025 12:23:59 PM MDT
|Attacker Funding ETH Wallet
|The attacker who would later drain the bridge funds their Ethereum wallet with an initial 0.12367348 ETH from KuCoin.
|-
|May 31st, 2025 7:38:10 PM MDT
|Attacker Funds BSC Wallet
|The attacker funds their BSC wallet with an initial
|-
|June 1st, 2025 1:12:59 AM MDT
|First Failed Attack Transaction
|The first transaction on the Ethereum blockchain (which failed).
|-
|June 1st, 2025 1:16:47 AM MDT
|Successful Ethereum Transaction
|The first successful attack transaction on the Ethereum blockchain, which is estimated to take $2.69M USD worth of Ethereum, USDC, wrapped bitcoin, USDT, and DAI.
|-
|June 1st, 2025 1:22:59 AM MDT
|Another Ethereum Success Transaction
|The second successful attack transaction on the Ethereum blockchain which takes some additional wrapped bitcoin.
|-
|June 1st, 2025 1:30:26 AM MDT
|First Attempt On Binance Smart Chain
|The first attempt at draining through the Binance Smart Chain. This is ultimately reverted due to the transfer amount exceeding the balance.
|-
|June 1st, 2025 1:36:08 AM MDT
|First BSC Success Transaction
|The first successful attack on the Binance Smart Chain takes 873.93788 BNB.
|-
|June 1st, 2025 1:52:16 AM MDT
|Second BSC Success Transaction
|The second successful attack on the Binance Smart Chain takes a smaller balance of USDC, BTCB, BSC-USD, and BUSD.
|-
|June 1st, 2025 9:12:00 PM MDT
|Magick Base Abnormal Activity
|Magick Base reports that the platform has temporarily suspended operations on its cross-chain bridge due to suspicious activity, prioritizing user security while a full investigation is underway. Further updates are expected as the situation develops.
|-
|June 2nd, 2025 12:42:00 AM MDT
|CyversAlert Tweet Posted
|CyversAlert posts a tweet with information about the amount of funds lost. They reports that all funds were swapped to ethereum and sent to TornadoCash.
|-
|June 2nd, 2025 3:54:00 AM MDT
|The Block News Report
|The Block reports on the incident. A suspicious address reportedly hijacked the bridge, siphoning funds including USDT, ETH, USDC, DAI, and wrapped bitcoin, before converting the assets to ETH and laundering them through Tornado Cash. In response, Magickbase, a key Nervos contributor, paused the bridge service and launched an investigation. The incident comes shortly after Magickbase announced plans to sunset Force Bridge by November 2025 due to low usage and high maintenance costs.
|}

== Technical Details ==
The Force Bridge exploit was a carefully orchestrated attack that leveraged admin-level access control vulnerabilities rather than a traditional code exploit. The attacker managed to systematically unlock and transfer assets across Ethereum and BNB Chain, using privileged functions like unlock() that are typically restricted to trusted operators. This level of access suggests the attacker either had stolen keys, obtained credentials through social engineering, or was potentially someone with insider knowledge. What makes the attack more suspicious is its precise timing—it occurred just hours after Magickbase, the Force Bridge operator, announced the protocol’s planned sunset.

Technically, the exploit unfolded in multiple stages. On June 1st, the attacker made several failed attempts on Ethereum before successfully executing transactions totaling over $3.1 million. The pattern was repeated on BNB Chain, where another $634,000 was drained. Each stage of the attack was preceded by funding transactions to dedicated wallets from KuCoin, with addresses specifically set up for each chain. Once the assets were unlocked and moved, they were immediately laundered through Tornado Cash and FixedFloat, leaving minimal trace and no opportunity for recovery. The transactions showed no signs of complex mechanisms like flash loans—just direct, efficient use of illicit privileges.

Forensics from Hacken and Cyvers further confirmed the methodical nature of the breach. The attacker’s wallet activity began shortly after the Force Bridge sunset announcement, suggesting rapid mobilization—possibly by someone already aware of the protocol’s internal structure or possessing credentials. The absence of communication from Force Bridge itself (which lacked a public presence) and the sole reliance on Magickbase’s social media to disclose the incident added to concerns about transparency. With no official post-mortem and the Nervos Foundation shifting public focus to other projects, the exploit’s narrative remains one of mystery, raising serious questions about operational security, shutdown procedures, and trust in legacy DeFi infrastructure.

== Total Amount Lost ==
Rekt News reports $3.76 million. The Block reports losses over $3m, which they break down as "about 257,800 USDT, 539.09 ETH ($1.35 million), 898,300 USDC, 60,400 DAI, and 0.79 wrapped bitcoin worth roughly $83,000".

CyversAlert provides a break-down of the asserts which were taken:
257.8K $USDT
539.09 $ETH
898.3K $USDC
60.4K $DAI
0.79 $WBTC


The total amount lost has been estimated at $3,760,000 USD.

== Immediate Reactions ==
The community reaction to the Force Bridge exploit was a mix of suspicion, frustration, and resignation. Many observers were struck by the highly coincidental timing of the attack—coming just hours after Magickbase announced plans to sunset the bridge—leading to speculation that the exploit may have involved insider knowledge or compromised administrative credentials. The lack of a timely and direct response from the official Nervos Foundation only fueled further skepticism. Instead of addressing the exploit directly, the Foundation issued general messaging about decentralization and future plans, which some viewed as an attempt to deflect responsibility.

Community members on platforms like REKT and Twitter expressed concern over the lack of operational discipline and questioned the transparency of the shutdown process. Some called for stronger security practices around decommissioning protocols, especially those that retain admin keys post-deployment. Others highlighted how Force Bridge’s quiet operational presence—no official Twitter account or consistent updates—left users vulnerable and uninformed during a critical moment.

== Ultimate Outcome ==
Despite the lack of a definitive explanation, most of the blockchain community seemed to interpret the event as a cautionary tale about the dangers of centralized control within DeFi bridges. The exploit reinforced the need for proper key management, open communication, and thorough offboarding protocols for legacy infrastructure. While conspiracy theories about an "inside job" circulated, many leaned toward the theory that someone with previously obtained credentials acted quickly upon seeing the sunset announcement, exploiting a narrow window of opportunity.

== Total Amount Recovered ==
It does not appear that any funds have been recovered for affected users.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
While Magickbase, the infrastructure partner managing the bridge, acknowledged the exploit and paused the service, no detailed post-mortem has been released. Blockchain security firms like Cyvers and Hacken continue to analyze wallet activity and transaction trails, but the core questions—how the attacker gained admin-level access and whether any internal party was involved—are still unanswered. This uncertainty has left the door open for speculation, and until a definitive explanation is provided, trust in the handling of the incident remains shaky.

The Nervos Foundation has distanced itself from direct involvement in Force Bridge’s operation, instead highlighting the decentralized nature of its network. However, this response has been seen by some as evasive, especially since the exploit affected users and assets within the broader Nervos ecosystem. The lack of direct communication from Force Bridge—given it had no official presence—has further frustrated users. Community members are still seeking clarity on whether proper procedures were followed during the sunset process and why critical access controls weren’t revoked ahead of time.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="magickbasetweet1-20125">[https://twitter.com/magickbase/status/1929375666396418247 Magick Base - "We’ve detected abnormal activity on #ForceBridge and have paused the service as a precaution. Our team is investigating. Updates will be shared ASAP. Thank you for your patience." - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="theblock-20126">[https://www.theblock.co/post/356535/hackers-drain-over-3-million-in-crypto-from-nervos-networks-force-cross-chain-bridge-say-security-analysts Hackers drain over $3 million in crypto from Nervos Network’s Force cross-chain bridge, say security analysts - The Block] (Accessed Jun 10, 2025)</ref>

<ref name="cyversaltertweet-20127">[https://twitter.com/CyversAlerts/status/1929428359856935185 CyversAlert - "ALERT: Our system has detected multiple suspicious transactions involving @NervosNetwork. A suspicious address appears to have taken control over the bridge, stealing ~$3M in assets: 257.8K $USDT, 539.09 $ETH, 898.3K $USDC, 60.4K $DAI, 0.79 $WBTC. All funds were swapped to $ETH and sent to @TornadoCash. The team has paused all contracts and is actively investigating the incident." - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="magickbasetweet2-20128">[https://twitter.com/magickbase/status/1928871653934837987 Magick Base - "Hey Vanguards in the community, Thank you for your continued support of the CKB ecosystem. Today, we’re sharing an important update about two of our early infrastructure pillars: Force Bridge and Godwoken. They will officially begin sunsetting on 2025/06/01." - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="extractorweb3tweet-20129">[https://twitter.com/extractor_web3/status/1929444219757756584 Extractor Web3 - "Security Alert Nervos Network's ForceBridge was exploited due to Access Control vulnerability for $3.9m worth of assets ($3.1m on ETH and $800k on BNB Chain)! There was failed attempt to execute an attack 6 hours prior to successful one." - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="halborn-20130">[https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025 Explained: The Force Bridge Hack (June 2025) - Halborn] (Accessed Jun 10, 2025)</ref>

<ref name="etherscan1-20131">[https://etherscan.io/tx/0x0da4f731d05fce5358eb61115f71dad002d6b8b0c414d3269d8e45e7fa297e4d Initial Funding With 0.12367348 ETH - EtherScan] (Accessed Jun 10, 2025)</ref>

<ref name="etherscan2-20132">[https://etherscan.io/address/0x1998c6d25212194ebf9bb919b87d40b2dc8aa8b9 Attacker Address - EtherScan] (Accessed Jun 10, 2025)</ref>

<ref name="bscscan1-20133">[https://bscscan.com/tx/0xa29463be9b81b126d22bb2f6e8001ed36f0bbd71f2b2da763a538e732e747c25 Initial Funding With 0.49 BNB - BSCScan] (Accessed Jun 10, 2025)</ref>

<ref name="bscscan2-20134">[https://bscscan.com/address/0x1998c6d25212194ebf9bb919b87d40b2dc8aa8b9 Attacker Address - BSCScan] (Accessed Jun 10, 2025)</ref>

<ref name="runningckbtweet-20135">[https://twitter.com/RunningCKB/status/1932241744151601509 Running CKB - "Like many of you, we are eagerly awaiting further developments in regard to the hack of Force Bridge. We pride ourselves in living by the mantra of "don't trust, verify" and in this moment it is very clear that somewhere along the way, meeting the market led to adoption of designs that compromised on this absolutely essential principle. The motivation to shut down Godwoken & Force Bridge was to eliminate dormant risks, which this hack immediately brought to light." - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="etherscan3-20136">[https://etherscan.io/tx/0x69104f6b14faa6d77ae9837f6d5d01134b2af0e620d54a0723fdd931b40a87c7 First Failed Transaction (Reverted) - EtherScan] (Accessed Jun 10, 2025)</ref>

<ref name="etherscan4-20137">[https://etherscan.io/tx/0x6b6fbd9d6beef56d2a4f0d14852beea381764b962d7d73ecd216b9fd991299a1 First Successful Transaction For ETH,USDC,WBTC,USDT, and DAI - EtherScan] (Accessed Jun 10, 2025)</ref>

<ref name="etherscan5-20138">[https://etherscan.io/tx/0x9859b6cbb2764a6cb86450cd7b514f54766b461735da081195226265d72a75fa Second Successful Transaction For 4.22885909 WBTC - EtherScan] (Accessed Jun 10, 2025)</ref>

<ref name="bscscan3-20139">[https://bscscan.com/tx/0x57a8d7b0fe1ad8b9159a37a09b3379e82cc85eb047528a5cef09dbf98b881357 First Failed Transaction (Reverted) - BSCScan] (Accessed Jun 10, 2025)</ref>

<ref name="bscscan4-20140">[https://bscscan.com/tx/0x4c7e83126e9327fe62cb8e3dab72121062eaf213852fd581e7ada43c93ea58a4 First Successful Transaction For 873.93788 BNB - BSCScan] (Accessed Jun 10, 2025)</ref>

<ref name="bscscan5-20141">[https://bscscan.com/tx/0x555b07899ea87be062a7df84220b38fdf93aded10ad09229e9265bed5753744b Second Successful Transaction For USDC, BTCB, BSC-USD, and BUSD - BSCScan] (Accessed Jun 10, 2025)</ref>

<ref name="sunsetforcebridge1-20142">[https://sunset.forcebridge.com/ End of an Era: Force Bridge Sunset - Force Bridge Sunset] (Accessed Jun 10, 2025)</ref>

<ref name="sunsetforcebridge2-20143">[https://sunset.forcebridge.com/announcement Sunset of Force Bridge and Godwoken - Sunset.ForceBridge.com] (Accessed Jun 10, 2025)</ref>

<ref name="startwithnervos1-20144">[https://startwithnervos.com/event/force-bridge-uiux-design-contest-winners Force Bridge UI/UX Design Contest Winners - Start With Nervos] (Accessed Jun 10, 2025)</ref>

<ref name="nervoshome-20145">[https://www.nervos.org/ Nervos Network Homepage] (Accessed Jun 10, 2025)</ref>

<ref name="forkastnews-20146">[https://forkast.news/nervos-launches-cross-chain-force-bridge/ Public blockchain Nervos launches cross-chain ‘Force Bridge’ on mainnet - Forkast News] (Accessed Jun 10, 2025)</ref>

<ref name="startwithnervos2-20147">[https://startwithnervos.com/nervos-faq/what-is-force-bridge What is Force Bridge? - Start With Nervos] (Accessed Jun 10, 2025)</ref>

<ref name="cypherhunter-20148">[https://www.cypherhunter.com/en/p/force-bridge/ Force Bridge - CypherHunter] (Accessed Jun 10, 2025)</ref>

<ref name="runningckbtweet-20149">[https://twitter.com/RunningCKB/status/1929964455049281617 CKB Eco Fund - "Don't trust, verify" - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="neuronmagickbase-20150">[https://neuron.magickbase.com/ Securely Manage Your CKB Assets with Ease - Neuron] (Accessed Jun 10, 2025)</ref>

<ref name="github-20151">[https://github.com/magickbase Magickbase - GitHub] (Accessed Jun 10, 2025)</ref>

<ref name="nervosnetworktwitterx-20152">[https://twitter.com/nervosnetwork Nervos Network - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="nervosorg-20153">[https://www.nervos.org/knowledge-base/tokenomics_of_nervos_network A Deep Dive Into the Tokenomics of Nervos Network - Nervos.org] (Accessed Jun 10, 2025)</ref>

<ref name="messariio-20154">[https://messari.io/project/nervos-network Nervos Network - Messari.io] (Accessed Jun 10, 2025)</ref>

<ref name="cryptotimes-20155">[https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/ Nervos Network’s Force Bridge Loses $3 Million in DeFi Exploit - CryptoTimes] (Accessed Jun 10, 2025)</ref>

<ref name="nervosmediakit-20156">[https://www.nervos.org/media-kit Media Kit - Nervos.org] (Accessed Jun 10, 2025)</ref>

<ref name="nervosnationtwitterx-20157">[https://twitter.com/nervosnation Nervos Nation - Twitter/X] (Accessed Jun 10, 2025)</ref>

<ref name="nervosnetworkreddit-20158">[https://www.reddit.com/r/NervosNetwork/ Nervos Network - Reddit] (Accessed Jun 10, 2025)</ref></references>