--- title: "Bitcoin L2 protocol bridge Alex suffers $4.3M in losses after suspicious upgrades" url: https://diffcoin.com/bitcoin-l2-protocol-bridge-alex-suffers-4-3m-in-losses-after-suspicious-upgrades/ description: "The Alex bridge on BNB network was drained of $4.3M after a series of suspicious contract upgrades, reports CertiK." published: 2024-05-14 updated: 2024-05-14 author: "Mila" site: "Diffcoin" --- # Bitcoin L2 protocol bridge Alex suffers $4.3M in losses after suspicious upgrades Share this article ![Follow Crypto Briefing on Google News](https://static.cryptobriefing.com/wp-content/uploads/2024/04/05153217/follow-us-on-google-news.png) The Alex protocol bridge on the BNB network has experienced $4.3 million in suspicious withdrawals following a sudden contract upgrade, according to a report from blockchain security platform CertiK on May 14. > [#CertiKInsight](https://twitter.com/hashtag/CertiKInsight?src=hash&ref_src=twsrc%5Etfw) 🚨 > > We have seen a suspicious transaction affecting [@ALEXLabBTC](https://twitter.com/ALEXLabBTC?ref_src=twsrc%5Etfw) > > Initial evidence points to a possible private key compromise. > > Deployer of 0xb3955302E58FFFdf2da247E999Cd9755f652b13b upgrades to a suspicious implementation. > > In total ~$4.3m worth of assets have… [pic.twitter.com/02kiw2dFrm](https://t.co/02kiw2dFrm) > > — CertiK Alert (@CertiKAlert) [May 14, 2024](https://twitter.com/CertiKAlert/status/1790432967422083329?ref_src=twsrc%5Etfw) The incident, which CertiK labeled as “a possible private key compromise,” has raised concerns about the security of the Bitcoin layer-2 protocol’s bridges. At the time of writing, the team from Alex has yet to confirm the exploit. Data from BscScan indicates that the Alex deployer initiated five upgrades to the platform’s Bridge Endpoint contract on the BNB Smart Chain. Following these upgrades, approximately $4.3 million worth of Binance-Pegged Bitcoin (BTC), USD Coin (USDC), and Sugar Kingdom Odyssey (SKO) were removed from the BNB Smart Chain side of the bridge. The upgrade transaction call effectively changed the implementation address to unverified bytecode, rendering the change inconspicuous to human language. Further investigation into the 05ed account revealed that it had created one unverified contract on May 10 and two more on May 14, despite having no prior activity. This suspicious behavior suggests that the account may be controlled by a malicious actor attempting to exploit the Alex protocol across multiple networks. In less than an hour after the upgrades were initiated, the proxy address for the bridge contract called an unverified function on another address, transferring 16 BTC ($983,000), 2.7 million SKO ($75,000), and $3.3 million worth of USDC. Shortly after, an account ending in 05ed, which had no transaction history before May 10, attempted to make two withdrawals from the “team address.” However, these withdrawal attempts failed, triggering a “not owner” error message. According to CertiK, it is possible that the attacker may have also attempted to drain funds from other networks, given how similar upgrades for the Alex protocol were also seen on Ethereum right after its initial changes. Share this article ![Follow Crypto Briefing on Google News](https://static.cryptobriefing.com/wp-content/uploads/2024/04/05153217/follow-us-on-google-news.png) The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information. Crypto Briefing may augment articles with AI-generated content created by Crypto Briefing’s own proprietary AI platform. We use AI as a tool to deliver fast, valuable and actionable information without losing the insight – and oversight – of experienced crypto natives. All AI augmented content is carefully reviewed, including for factural accuracy, by our editors and writers, and always draws from multiple primary and secondary sources when available to create our stories and articles. You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities. See full terms and conditions. [Source link](https://cryptobriefing.com/alex-l2-protocol-bridge-drained/)