{"id":12662,"date":"2026-09-01T18:10:13","date_gmt":"2026-09-01T18:10:13","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12662"},"modified":"2026-09-01T18:10:13","modified_gmt":"2026-09-01T18:10:13","slug":"icon-replay-exploit-reuses-signatures-1490-times","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12662","title":{"rendered":"ICON replay exploit reuses signatures 1,490 times"},"content":{"rendered":"<p><\/p>\n<div data-single-article-content=\"\">\n<p>According to the ICON Foundation, the Aug. 27 ICON replay exploit released 119,866,000 ICX and 531,600 bnUSD from foundation-held assets after two legitimate withdrawal messages were reused 1,492 times. Its Aug. 30 postmortem said 1,490 calls succeeded, while no user deposits, balances or positions were accessed.<\/p>\n<p>The headline-sized ICX release is not the same as the confirmed loss. ICON put net loss to date at about 150.2 ETH plus 31,204 USDC, with the vast majority of the ICX traced, frozen and in active recovery. The foundation said bnUSD and SODA were recovered in full, but exchange-held amounts remain subject to revision. That distinction matters because ICON had not received exact exchange figures for how much ICX was held, converted or withdrawn.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Harmony weighs a full blockchain rollback after unauthorized minting floods exchanges with billions in ONE<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The flaw let the attacker change part of a withdrawal identifier without changing the signed payload being verified. ICON traced the mismatch to a change intended to standardize withdrawal messages at 32 bytes, which routed part of the serial number through float64-range logic rather than exact integer arithmetic.<\/p>\n<p>As a result, the contract&#8217;s uniqueness check looked at high bits the attacker could vary, while cryptographic verification covered the unchanged low 256 bits. The signed payload and signature remained identical within each replay set, but the altered unsigned portion made the calls appear unique. Two calls reverted; every successful call credited the same relayer wallet. ICON said the flaw was specific to its implementation because other supported chains used fixed-width integers that could not produce the same mismatch.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining the Daily Brief\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Daily Brief <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">The signal, before the noise.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start your day with the crypto stories moving markets, decoded by CryptoSlate\u2019s editors.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__form-heading\">One email. Everything that matters.<\/p>\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Free to join. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span><strong>You\u2019re on the list.<\/strong> Your next Daily Brief is on its way.<\/span><\/p>\n<\/div>\n<\/div>\n<\/aside>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Polkadot Hyperbridge April Fools\u2019 joke comes true as over 1 Billion fake DOT tokens were minted on Ethereum<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p> <img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-559237\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-8aa62e50-bd9e-4eab-a8bf-c9c3edc25927.png\" alt=\"ICON replay exploit timeline showing 1,492 replay attempts, 1,490 successful calls, the first alert, investigation, contract pause, network halt and restart.\" width=\"720\" height=\"900\"\/><img decoding=\"async\" class=\"lazyload aligncenter wp-image-559237\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-8aa62e50-bd9e-4eab-a8bf-c9c3edc25927.png\" alt=\"ICON replay exploit timeline showing 1,492 replay attempts, 1,490 successful calls, the first alert, investigation, contract pause, network halt and restart.\" width=\"720\" height=\"900\"\/><\/p>\n<h2>Detection of the ICON replay exploit came before containment<\/h2>\n<p>ICON&#8217;s monitoring system fired at 02:08 UTC, seven minutes after the exploit began. Technical staff started investigating at about 03:40, a 92-minute gap. The affected contract was paused at 03:53, 105 minutes after the alert.<\/p>\n<p>The attacker had begun splitting ICX across exchange deposit addresses at 02:44, according to ICON, and the distribution continued until about 05:20. The foundation said an ICON-side pause could not stop movement of funds already swept into exchange custody.<\/p>\n<p>The network was halted at 06:18:54 and resumed at about 07:51 the next day, roughly 25 hours later. Public notices from Bitvavo, Bitget and KuCoin confirm that ICX deposits and withdrawals were suspended around the incident, though none identifies itself as holding attacker funds or verifies the amount frozen.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Crypto users told to pull funds after Ethereum L2 bridge failure exposes rollup exit risk<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>A November 2025 relay audit reviewed selected relay and verifier code, including ICON verifier files, but its published scope did not list the affected migration-contract source. None of its nine disclosed findings flagged the serial-number mismatch. ICON said incident-related relay logic had been audited, but that the gap fell outside the findings.<\/p>\n<\/div>\n<p>Featured,Hacks,Outage,ethereum,stablecoins,USDCethereum,stablecoins,USDC#ICON #replay #exploit #reuses #signatures #times1788286213<\/p>\n","protected":false},"excerpt":{"rendered":"<p>According to the ICON Foundation, the Aug. 27 ICON replay exploit released 119,866,000 ICX and 531,600 bnUSD from foundation-held assets after two legitimate withdrawal messages were reused 1,492 times. Its Aug. 30 postmortem said 1,490 calls succeeded, while no user deposits, balances or positions were accessed. The headline-sized ICX release is not the same as<\/p>\n","protected":false},"author":1,"featured_media":12663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[31,664,6653,6363,6654,321,282,623,1582],"class_list":["post-12662","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-ethereum","tag-exploit","tag-icon","tag-replay","tag-reuses","tag-signatures","tag-stablecoins","tag-times","tag-usdc"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>ICON replay exploit reuses signatures 1,490 times - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"ICON replay exploit postmortem says two signatures were reused 1,492 times, causing a 25-hour halt and losses of 150.2 ETH and 31,204 USDC.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12662\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ICON replay exploit reuses signatures 1,490 times\" \/>\n<meta property=\"og:description\" content=\"ICON replay exploit postmortem says two signatures were reused 1,492 times, causing a 25-hour halt and losses of 150.2 ETH and 31,204 USDC.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12662\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T18:10:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12662\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12662\",\"name\":\"ICON replay exploit reuses signatures 1,490 times - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12662#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12662#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg\",\"datePublished\":\"2026-09-01T18:10:13+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"ICON replay exploit postmortem says two signatures were reused 1,492 times, causing a 25-hour halt and losses of 150.2 ETH and 31,204 USDC.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12662#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12662\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12662#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12662#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ICON replay exploit reuses signatures 1,490 times\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"ICON replay exploit reuses signatures 1,490 times - Crypto News: Latest Cryptocurrency News and Analysis","description":"ICON replay exploit postmortem says two signatures were reused 1,492 times, causing a 25-hour halt and losses of 150.2 ETH and 31,204 USDC.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12662","og_locale":"en_US","og_type":"article","og_title":"ICON replay exploit reuses signatures 1,490 times","og_description":"ICON replay exploit postmortem says two signatures were reused 1,492 times, causing a 25-hour halt and losses of 150.2 ETH and 31,204 USDC.","og_url":"https:\/\/cryptonews.uk.com\/?p=12662","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-01T18:10:13+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12662","url":"https:\/\/cryptonews.uk.com\/?p=12662","name":"ICON replay exploit reuses signatures 1,490 times - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12662#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12662#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg","datePublished":"2026-09-01T18:10:13+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"ICON replay exploit postmortem says two signatures were reused 1,492 times, causing a 25-hour halt and losses of 150.2 ETH and 31,204 USDC.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12662#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12662"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12662#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/icon-checkpoint-replay-surge.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12662#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"ICON replay exploit reuses signatures 1,490 times"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12662"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12662\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12663"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}