Nervos Network Force Bridge Drained Shortly After Sunset

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Nervos Network Force Bridge Logo/Template

Force Bridge, a cross-chain protocol on the Nervos Network, was developed to enable interoperability between blockchains like Ethereum and BNB Chain using smart contracts and token wrapping. Initially praised for expanding Nervos’s DeFi and multi-chain ecosystem, Force Bridge faced a dramatic downfall following a $3.76 million exploit just hours after its planned sunset was announced by Magickbase, citing low activity and high costs. The attack exploited admin-level privileges—likely through compromised credentials or insider access—raising serious concerns about operational security and transparency. With no official post-mortem or fund recovery, the incident has fueled community suspicion and highlighted the dangers of centralized control in DeFi infrastructure.

About Force Bridge

Force Bridge is a cross-chain protocol developed on the Nervos Network to enable seamless asset transfers and interoperability between otherwise isolated blockchains. By leveraging smart contracts and token wrapping technology, Force Bridge facilitates decentralized finance (DeFi) operations across multiple blockchain ecosystems. It initially launched with support for Ethereum and ERC-20 tokens such as USDT, USDC, and DAI, and aims to expand compatibility to networks like Bitcoin, Cardano, TRON, EOS, and Polkadot, offering broad cross-chain functionality within a unified framework.

Launched on Nervos mainnet in 2021, Force Bridge represents a strategic milestone in Nervos’s roadmap toward creating an interconnected blockchain ecosystem. Nervos positioned the bridge as a foundational piece of its multi-chain infrastructure, alongside other tools like Godwoken and Polyjuice. These components are designed to support "Universal Applications"—decentralized apps that can operate across multiple blockchains without being limited by their native platforms. This architecture allows developers and users to engage in multi-chain transactions securely and efficiently, without compromising on decentralization or usability.

The significance of Force Bridge extends beyond technical functionality; it also reflects Nervos’s broader vision of building a modular, scalable network that supports a global blockchain ecosystem. Backed by major players like China Merchants Bank International and Sequoia China, and integrated with China’s Blockchain-based Services Network (BSN), Nervos has attracted institutional interest. Additionally, Nervos’s collaboration with IOHK on a bridge to Cardano and the launch of a $50 million ecosystem fund further highlight its commitment to fostering cross-chain development and DeFi innovation.

About Nervos Network

The Nervos Network is a modular, multi-layered blockchain ecosystem designed to address some of the most pressing challenges in the blockchain industry, such as scalability, interoperability, and decentralization. Launched in 2019, the Nervos Network mainnet set out to build a connected on-chain ecosystem, utilizing tools like Force Bridge to facilitate interoperability across blockchains.

At its core is the Common Knowledge Base (CKB), a Layer 1 blockchain that provides a secure, permissionless, and decentralized foundation for the network. CKB is built using the Proof-of-Work (PoW) consensus mechanism and leverages the UTXO model, making it compatible with Bitcoin-like architectures. Its primary role is to act as a base layer for securing data, value, and smart contracts, while higher-performance Layer 2 networks handle transaction throughput and user-facing applications.

What sets Nervos apart is its modular design philosophy. Instead of trying to do everything on one chain, Nervos separates concerns across layers. Layer 1 (CKB) focuses on decentralization and security, while Layer 2 solutions, such as Axon and Godwoken, are optimized for scalability and performance. This architecture enables developers to build high-throughput applications on top of a secure base without compromising on decentralization. It also allows for flexible integration with other blockchains, supporting a wide range of cryptographic primitives and standards, which makes Nervos uniquely positioned for cross-chain interoperability.

Nervos is also pioneering in its approach to Bitcoin interoperability. Through protocols like RGB++ and the UTXO Stack, CKB functions as a Bitcoin-isomorphic platform, enabling enhanced programmability and scalability for Bitcoin-based assets without requiring traditional cross-chain bridges. This opens the door for a more robust Bitcoin ecosystem, where decentralized applications can be built with native Bitcoin assets in a secure and scalable manner.

Finally, the Nervos ecosystem is supported by a vibrant community, active development teams, and initiatives like the CKB Eco Fund, which invests in projects that build on and expand the network. With a clear focus on long-term sustainability, Nervos also incorporates utility-driven tokenomics that align incentives for miners, developers, and users. Altogether, Nervos represents a comprehensive blockchain infrastructure built to support the next generation of decentralized applications and digital economies.

The Reality

Prior to this incident, developers had shared a plan to sunset the project by November 2025. Magickbase had announced plans to sunset Force Bridge, citing low user activity and high maintenance costs in a notice published May 31.

"Over the past few years, Force Bridge and Godwoken have played pivotal roles in expanding the Nervos CKB ecosystem — enabling multi-chain asset interoperability, EVM compatibility, and DApp development. These two products marked Nervos' first major steps toward a layered architecture and cross-chain infrastructure.

However, as the industry evolves and the ecosystem pivots toward UTXO-native capabilities, off-chain services, and value-centric automation, it's time to sunset these early-stage components to make way for the next era of Nervos."

What Happened

Force Bridge, a cross-chain protocol on the Nervos Network, was compromised in a suspected DeFi exploit, resulting in over $3 million in stolen crypto assets.

Key Event Timeline - Nervos Network Force Bridge Drained Shortly After Sunset

Date	Event	Description
October 14th, 2021 2:36:00 AM MDT	Force Bridge Launched	The Force Bridge on the Nervos Network is launched.
May 31st, 2025 11:50:00 AM MDT	Sunset Period Announced	A public tweet by Magick announces the sunset of the Force Bridge and Godwoken projects.
May 31st, 2025 12:23:59 PM MDT	Attacker Funding ETH Wallet	The attacker who would later drain the bridge funds their Ethereum wallet with an initial 0.12367348 ETH from KuCoin.
May 31st, 2025 7:38:10 PM MDT	Attacker Funds BSC Wallet	The attacker funds their BSC wallet with an initial
June 1st, 2025 1:12:59 AM MDT	First Failed Attack Transaction	The first transaction on the Ethereum blockchain (which failed).
June 1st, 2025 1:16:47 AM MDT	Successful Ethereum Transaction	The first successful attack transaction on the Ethereum blockchain, which is estimated to take $2.69M USD worth of Ethereum, USDC, wrapped bitcoin, USDT, and DAI.
June 1st, 2025 1:22:59 AM MDT	Another Ethereum Success Transaction	The second successful attack transaction on the Ethereum blockchain which takes some additional wrapped bitcoin.
June 1st, 2025 1:30:26 AM MDT	First Attempt On Binance Smart Chain	The first attempt at draining through the Binance Smart Chain. This is ultimately reverted due to the transfer amount exceeding the balance.
June 1st, 2025 1:36:08 AM MDT	First BSC Success Transaction	The first successful attack on the Binance Smart Chain takes 873.93788 BNB.
June 1st, 2025 1:52:16 AM MDT	Second BSC Success Transaction	The second successful attack on the Binance Smart Chain takes a smaller balance of USDC, BTCB, BSC-USD, and BUSD.
June 1st, 2025 9:12:00 PM MDT	Magick Base Abnormal Activity	Magick Base reports that the platform has temporarily suspended operations on its cross-chain bridge due to suspicious activity, prioritizing user security while a full investigation is underway. Further updates are expected as the situation develops.
June 2nd, 2025 12:42:00 AM MDT	CyversAlert Tweet Posted	CyversAlert posts a tweet with information about the amount of funds lost. They reports that all funds were swapped to ethereum and sent to TornadoCash.
June 2nd, 2025 3:54:00 AM MDT	The Block News Report	The Block reports on the incident. A suspicious address reportedly hijacked the bridge, siphoning funds including USDT, ETH, USDC, DAI, and wrapped bitcoin, before converting the assets to ETH and laundering them through Tornado Cash. In response, Magickbase, a key Nervos contributor, paused the bridge service and launched an investigation. The incident comes shortly after Magickbase announced plans to sunset Force Bridge by November 2025 due to low usage and high maintenance costs.

Technical Details

The Force Bridge exploit was a carefully orchestrated attack that leveraged admin-level access control vulnerabilities rather than a traditional code exploit. The attacker managed to systematically unlock and transfer assets across Ethereum and BNB Chain, using privileged functions like unlock() that are typically restricted to trusted operators. This level of access suggests the attacker either had stolen keys, obtained credentials through social engineering, or was potentially someone with insider knowledge. What makes the attack more suspicious is its precise timing—it occurred just hours after Magickbase, the Force Bridge operator, announced the protocol’s planned sunset.

Technically, the exploit unfolded in multiple stages. On June 1st, the attacker made several failed attempts on Ethereum before successfully executing transactions totaling over $3.1 million. The pattern was repeated on BNB Chain, where another $634,000 was drained. Each stage of the attack was preceded by funding transactions to dedicated wallets from KuCoin, with addresses specifically set up for each chain. Once the assets were unlocked and moved, they were immediately laundered through Tornado Cash and FixedFloat, leaving minimal trace and no opportunity for recovery. The transactions showed no signs of complex mechanisms like flash loans—just direct, efficient use of illicit privileges.

Forensics from Hacken and Cyvers further confirmed the methodical nature of the breach. The attacker’s wallet activity began shortly after the Force Bridge sunset announcement, suggesting rapid mobilization—possibly by someone already aware of the protocol’s internal structure or possessing credentials. The absence of communication from Force Bridge itself (which lacked a public presence) and the sole reliance on Magickbase’s social media to disclose the incident added to concerns about transparency. With no official post-mortem and the Nervos Foundation shifting public focus to other projects, the exploit’s narrative remains one of mystery, raising serious questions about operational security, shutdown procedures, and trust in legacy DeFi infrastructure.

Total Amount Lost

Rekt News reports $3.76 million. The Block reports losses over $3m, which they break down as "about 257,800 USDT, 539.09 ETH ($1.35 million), 898,300 USDC, 60,400 DAI, and 0.79 wrapped bitcoin worth roughly $83,000".

CyversAlert provides a break-down of the asserts which were taken: 257.8K $USDT 539.09 $ETH 898.3K $USDC 60.4K $DAI 0.79 $WBTC

The total amount lost has been estimated at $3,760,000 USD.

Immediate Reactions

The community reaction to the Force Bridge exploit was a mix of suspicion, frustration, and resignation. Many observers were struck by the highly coincidental timing of the attack—coming just hours after Magickbase announced plans to sunset the bridge—leading to speculation that the exploit may have involved insider knowledge or compromised administrative credentials. The lack of a timely and direct response from the official Nervos Foundation only fueled further skepticism. Instead of addressing the exploit directly, the Foundation issued general messaging about decentralization and future plans, which some viewed as an attempt to deflect responsibility.

Community members on platforms like REKT and Twitter expressed concern over the lack of operational discipline and questioned the transparency of the shutdown process. Some called for stronger security practices around decommissioning protocols, especially those that retain admin keys post-deployment. Others highlighted how Force Bridge’s quiet operational presence—no official Twitter account or consistent updates—left users vulnerable and uninformed during a critical moment.

Ultimate Outcome

Despite the lack of a definitive explanation, most of the blockchain community seemed to interpret the event as a cautionary tale about the dangers of centralized control within DeFi bridges. The exploit reinforced the need for proper key management, open communication, and thorough offboarding protocols for legacy infrastructure. While conspiracy theories about an "inside job" circulated, many leaned toward the theory that someone with previously obtained credentials acted quickly upon seeing the sunset announcement, exploiting a narrow window of opportunity.

Total Amount Recovered

It does not appear that any funds have been recovered for affected users.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

While Magickbase, the infrastructure partner managing the bridge, acknowledged the exploit and paused the service, no detailed post-mortem has been released. Blockchain security firms like Cyvers and Hacken continue to analyze wallet activity and transaction trails, but the core questions—how the attacker gained admin-level access and whether any internal party was involved—are still unanswered. This uncertainty has left the door open for speculation, and until a definitive explanation is provided, trust in the handling of the incident remains shaky.

The Nervos Foundation has distanced itself from direct involvement in Force Bridge’s operation, instead highlighting the decentralized nature of its network. However, this response has been seen by some as evasive, especially since the exploit affected users and assets within the broader Nervos ecosystem. The lack of direct communication from Force Bridge—given it had no official presence—has further frustrated users. Community members are still seeking clarity on whether proper procedures were followed during the sunset process and why critical access controls weren’t revoked ahead of time.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.