Worked example · 2023-07

Multichain MPC bridge verification-model collapse — multi-chain — 2023-07-06/07

Loss: approximately $126M+ extracted across multiple chains (Ethereum, BNB Chain, Polygon, Avalanche, Fantom, Arbitrum, Optimism, and others). Anomalous outflows from Multichain's MPC-controlled bridge wallets began on July 6, 2023 and continued through July 7; the funds were moved to externally-controlled addresses in a pattern inconsistent with normal bridge operations. Additional assets locked in Multichain contracts across ~100+ chains were rendered inaccessible as the bridge effectively ceased operations.
OAK Techniques observed: OAK-T10.005 (Light-Client / Merkle-Proof Verification Bypass — sub-case (c), Consensus-Rule Modelling Mismatch) — primary; the Multichain bridge's security model was marketed as a distributed SMPC (Secure Multi-Party Computation) verification network where no single party controlled the signing keys, but the operational reality was that the MPC node infrastructure was controlled by a single entity (the CEO and core team), and the verification model encoded "MPC threshold signatures are sufficient" without encoding the operational requirement that the MPC nodes must be operated by independent, geographically-distributed, adversarially-uncoordinated parties. OAK-T10.001 (Validator-Signer Key Compromise) — structurally co-occurring; the proximate mechanism was that the party controlling the MPC nodes moved funds using legitimate-looking MPC-signed transactions. OAK-T10.007 (Bridge Validator Economic-Incentive Misalignment) — structural condition; the validators had no at-risk economic stake bonding them to the bridge's security, making the operator-as-attacker self-dealing sub-case viable.
Attribution: unattributed The Multichain team's public statements attributed the incident to the arrest of CEO Zhaojun and several team members by Chinese authorities, with the MPC key shards held on cloud servers in China becoming inaccessible to the remaining team. Whether the subsequent fund movements were authorised by Chinese authorities, executed by the detained CEO under duress, conducted by a third party who gained access to the key infrastructure during the team's absence, or represented an exit-scam by the team themselves is unresolved in the public record at v0.1 cutoff. No regulator or law-enforcement agency has publicly attributed the incident to a named individual or group. OAK records the attribution as unresolved.
Key teaching point: A bridge whose verification model is specified as "distributed MPC threshold signing" but whose operational deployment concentrates MPC node control in a single entity is structurally a T10.005 sub-case (c) surface — the verification model encoded the cryptographic correctness of the MPC protocol but failed to encode the operational requirement that the signing nodes be operated by independent, adversarially-uncoordinated parties. The Multichain case is the canonical illustration that MPC bridges carry the same centralisation risk as multisig bridges when node operation is not independently distributed.

Summary

Multichain (formerly Anyswap) was one of the largest cross-chain bridge protocols by TVL and transaction volume, supporting asset transfers across ~100+ EVM and non-EVM chains. The bridge's security model was built on SMPC (Secure Multi-Party Computation): asset-movement authorisation required threshold signatures from a set of MPC nodes that jointly computed signing shares without any single node holding a complete private key. The architecture was marketed as cryptographically superior to multisig bridges because no single key existed to be stolen — the MPC computation itself was supposed to be the security guarantee.

The structural vulnerability was at the operational-deployment layer, not at the cryptographic-primitive layer. The MPC nodes were operated by the Multichain team on cloud infrastructure, with the CEO (Zhaojun) holding administrative control over the deployment. The verification model encoded "MPC threshold signatures authorise asset transfers" but did not encode "the MPC nodes must be operated by independent, adversarially-uncoordinated entities whose compromise requires coordinating across multiple organisations." The operational reality was that a single entity (the CEO, or a party with access to the CEO's cloud infrastructure) could cause the MPC nodes to produce valid threshold signatures — the MPC protocol was cryptographically sound, but the verification model failed to model the centralisation of node operation.

On July 6–7, 2023, anomalous outflows began from Multichain's MPC-controlled bridge wallets across multiple chains. The funds were moved in MPC-signed transactions that appeared cryptographically valid — the MPC threshold had been met. The Multichain team's public statements (July 7 onward) claimed that the CEO had been arrested by Chinese authorities in late May 2023, that the MPC key shards were stored on cloud servers in China under the CEO's control, and that the remaining team members — who were outside China — could not access the key infrastructure to prevent or reverse the outflows. The team advised users to stop using Multichain and to revoke contract approvals.

The incident effectively terminated Multichain's operations. Over $126M was moved to externally-controlled addresses across multiple chains and did not return. An additional material quantity of user funds locked in Multichain contracts across chains became inaccessible as the bridge infrastructure ceased operation. The incident crystallised the structural lesson that MPC bridges whose node operation is centralised under a single administrative domain carry the same verification-model-mismatch surface as multisig bridges whose threshold is controlled by a single entity — the cryptographic primitive (MPC vs. multisig) is different, but the verification-model gap (distributed assumption vs. centralised reality) is structurally identical.

For OAK's purposes, Multichain is the canonical worked example for T10.005 sub-case (c) — Consensus-Rule Modelling Mismatch — in the MPC-bridge context. The MPC protocol correctly produced threshold signatures for the outflows, just as the Harmony Horizon Bridge's multisig correctly verified 2-of-5 signatures for its extraction transactions. In both cases, the verification primitive functioned as specified, but the specification failed to encode the operational-security requirement that the signing parties be independent, adversarially-uncoordinated entities. The T10.005 surface is the gap between the cryptographic specification and the operational reality.

Timeline (UTC)

When	Event	OAK ref
Pre-2023	Multichain bridge deployed across ~100+ chains; MPC node infrastructure operated by Multichain team on cloud servers controlled by CEO Zhaojun	T10.005 surface present (verification model assumes distributed nodes; operational reality is centralised control)
2023-05 (late May)	Per Multichain team's subsequent public statements, CEO Zhaojun arrested by Chinese authorities; MPC key shards on China-based cloud servers become inaccessible to remaining team members outside China	(operator-side key-custody loss)
2023-05 to 2023-07-06	Multichain operations continue but with increasing anomalies; team communications become sporadic; cross-chain transaction delays reported by users	(pre-incident degradation)
2023-07-06	First anomalous outflows from Multichain MPC-controlled bridge wallets across Ethereum, BNB Chain, and other chains in a pattern inconsistent with normal bridge operations	T10.005 extraction onset
2023-07-07	Outflows continue and expand across additional chains; ~$126M+ total moved to externally-controlled addresses; Multichain team publicly discloses the incident and advises users to stop using the bridge	T10.005 + T10.001 extraction event
2023-07 to 2023-08	Multichain bridge effectively ceases operations; users with funds locked in bridge contracts on ~100+ chains unable to withdraw; multiple DeFi protocols with Multichain-wrapped assets experience cascading de-pegs	(blast-radius expansion)
2023-07 onward	Stablecoin issuers (Circle, Tether) freeze USDC/USDT at attacker addresses on Ethereum; ~$60M+ in stablecoins frozen — the primary recovery instrument in the incident	(recovery via issuer freeze)
Continuing	Attribution remains unresolved at v0.1; no regulator/law-enforcement public statement naming a responsible party; CEO's status not publicly confirmed; remaining extracted assets not recovered	(attribution and recovery status)

Realised extraction

$126M+ moved to externally-controlled addresses across multiple chains. An additional unquantified value of user funds locked in Multichain bridge contracts across ~100+ chains rendered inaccessible following the bridge's operational cessation. ~$60M+ in stablecoins (USDC, USDT) frozen by Circle and Tether at attacker addresses on Ethereum — the primary recovery instrument. Non-stablecoin assets (ETH, wrapped assets, alt-L1 tokens) not recovered.

Public references

Multichain official statements (July 7–14, 2023) — primary operator-side source for the arrest claim, the MPC key-shard custody narrative, and the operational-cessation advisory.
Chainalysis / Elliptic / TRM forensic analyses of the Multichain outflows — multi-chain extraction trace and laundering-route analysis.
Circle and Tether freeze announcements — stablecoin issuer-side recovery actions.
Cross-reference: T10.005 at techniques/T10.005-light-client-verification-bypass.md.
Cross-reference: examples/2022-10-binance-bsc-bridge.md — BSC Token Hub (BNB Bridge) proof-soundness bypass (T10.005 sub-case (d)).
Cross-reference: examples/2022-06-harmony-horizon-bridge.md — Harmony Horizon Bridge verification-threshold economic-security gap (T10.005 sub-case (c)).

Discussion

The Multichain incident is the most commercially significant illustration of the T10.005 sub-case (c) surface — Consensus-Rule Modelling Mismatch — in the bridge ecosystem. The MPC protocol was cryptographically sound: the threshold signatures that authorised the outflows were valid MPC computations. The verification model failed because it assumed the MPC nodes were operated by independent parties, while the operational reality was that a single entity (the CEO) controlled the entire node infrastructure. The T10.005 surface is the gap between the specification and the deployment.

Three structural observations:

MPC is not a substitute for operational distribution. The marketing claim "MPC eliminates single-key risk because no single node holds the full key" is true at the cryptographic layer but false at the operational layer if all MPC nodes are operated by the same entity. The defender heuristic should be: an MPC bridge whose nodes are all operated by a single administrative domain carries the same centralisation risk as a multisig bridge controlled by a single entity — the verification model assumes distribution that does not exist in practice.
Stablecoin issuer freezes are the most effective recovery instrument for large bridge incidents involving on-chain stablecoin extraction. Circle and Tether froze ~$60M+ in USDC/USDT at the attacker-controlled addresses, recovering a material fraction of the gross extraction. This recovery mechanism is available only for centralised stablecoins with freeze functions (USDC, USDT) and is not available for native assets (ETH, wrapped ETH, alt-L1 tokens). The Multichain recovery split — ~$60M stablecoins recovered via issuer freeze, non-stablecoin assets unrecovered — is the cleanest illustration of the issuer-freeze recovery asymmetry.
Cross-Technique mapping (T10.005 + T10.001 + T10.007) captures the structural layering of the incident. The proximate mechanism was T10.001 (the party controlling the MPC nodes moved funds using valid MPC signatures). The structural precondition was T10.005 (the verification model assumed distributed node operation but the deployment was centralised). The economic condition was T10.007 (the MPC nodes had no at-risk economic stake bonding them to the bridge's security). The three-Technique mapping is appropriate because the incident demonstrates the interdependence of the verification-model, key-custody, and economic-incentive layers of bridge security.