Funds from the ChainConnect incident have been returned
What happened
On 26 July 2026 the ChainConnect bridge (chainconnect.com) was compromised. Bridge operations were paused immediately.
Approximately $650,000 was drained from the bridge contracts in 23 transactions across four networks: Ethereum, BNB Smart Chain, Avalanche C-Chain and Polygon.
The attacker swapped the stolen assets into each chain's native token and consolidated the full amount into ETH at 0xd86cbc1892bfda05f3d7e6c17c71709b6ae957a5.
Terms of the agreement
On 28 July ChainConnect sent an on-chain message to that address from the bridge deployer 0x68d447e2a4c6e7c1945725939a0cbcb4a67f9b30. The terms: keep 15% as a whitehat bounty, return 85% to the project, public written acknowledgement as a whitehat, no civil claims and no independent identity-attribution efforts by ChainConnect. The offer stood until 31 July, 23:59 UTC.
Return transaction
Time: 18:30:59 UTC, 30 July 2026
From: 0xd86cbc1892bfda05f3d7e6c17c71709b6ae957a5
To: 0x840B3De19e3FAB72fa9A168bD8Dd71B678c57989
Amount: 280 ETH (85% of the agreed total)
Tx: 0xe78bfae09b6b8fab1057f472f605044dea8d066b73e5012837050a5bc6d6eb00
Confirmation from ChainConnect
"ChainConnect confirms that the controller of 0xd86cbc1892bfda05f3d7e6c17c71709b6ae957a5 has fulfilled the agreed return terms for the ChainConnect bridge incident of 26 July 2026.
We confirm receipt of 280 ETH to 0x840B3De19e3FAB72fa9A168bD8Dd71B678c57989 in tx 0xe78bfae09b6b8fab1057f472f605044dea8d066b73e5012837050a5bc6d6eb00.
The retained amount is acknowledged as the agreed whitehat bounty. ChainConnect considers its commitments under the agreement fulfilled and the matter resolved with the controller of 0xd86cbc1892bfda05f3d7e6c17c71709b6ae957a5."
ChainConnect, 31 July 2026
The investigation
The case was handled by the AML Crypto investigations team. From the first hours after the compromise we mapped the fund flows across all four networks, traced the swaps and consolidation, and identified the attacker's addresses.
The funds came back a full day before the offer expired – rather than being dispersed further through mixers and swap services.
Fund flow graph in Bholder
https://bholder.amlcrypto.io/shared/b1e47a79189345c3a1ecf87c08d2fa1d
We work incidents like this from hour one: tracing, attribution, exchange outreach, recovery negotiation.
@amlcrypto
