Aethir Halts Bridge Exploit, Caps Losses Below $90K

Highlights:

• Aethir has contained a bridge exploit and capped reported user losses below $90,000.
• The main ATH supply on Ethereum stayed intact, while the ETH-ARB bridge on Squid remained unaffected.
• A compensation plan, attacker wallet list, and post-mortem are planned for next week.

Decentralized GPU cloud computing network Aethir has halted a bridge exploit after attackers targeted contracts linked to Ethereum and other chains. The firm said via an X post on Friday that it detected the breach quickly, disconnected the contracts, and worked with exchanges to block tracked wallets. 

The response limited user losses to under $90,000, below estimates from the on-chain investigation platform PeckShield. The team also said its main ATH supply on Ethereum stayed fully intact.

Bridge Attack Leads to Rapid Shutdown Across Chains

The breach involved bridge contracts that connect Ethereum with Solana, zkSync, Sophon, and Beam. After spotting the attack, the project published the compromised addresses and asked users to avoid those contracts. It also said the ETH-ARB bridge on Squid remained unaffected, noting that the platform remains fully operational.

The company said it will publish a compensation plan next week for affected users. It also plans to share a post-mortem, a repayment outline, and a list of attacker wallets on Discord. For now, the team has focused on tracing funds and closing exit routes.

ATH Security Notice

We detected and contained a malicious attack on ATH bridge contracts connecting Ethereum to other chains.

Key facts:
• All compromised contracts have been disconnected. The exploit has been contained.

• The main ATH supply on Ethereum is fully intact and…

— Aethir (@AethirCloud) April 10, 2026

Additionally, Aethir said Binance, Upbit, Bithumb, and HTX helped blacklist wallets tied to the attacker. The company thanked ZeroShadow for supporting the investigation and reviewing the exploit path.

PeckShield had earlier flagged the issue after spotting unusual transactions tied to AethirOFTAdapter, the project’s cross-chain smart contract. PeckShield estimated about $400,000 in damage during its assessment. It also said the attacker bridged stolen tokens from the BNB Chain to Tron through a sequence of transfers, a design used to split the funds before teams could react.

According to the tracking data, the tokens first moved into a BNB Smart Chain wallet linked to deBridge. The attacker then moved the funds to Tron, distributing them across multiple addresses. This pattern matched a common playbook in crypto breaches, where speed matters as much as the exploit. As a result, wallet blacklisting became central to the response.

Security Breaches Remain a Major Concern in 2026

The exploit arrived during another stretch of crypto security incidents in 2026. PeckShield said losses from crypto hacks reached $52 million in March alone. The firm also reported a 96% monthly increase after a far lower total in February. Wallet compromise and phishing remained the most common scamming methods during that period.

#PeckShieldAlert In March 2026, the crypto space saw 20 major hacks totaling $52M – a 96% MoM surge from February ($26.5M). But the real damage lies in the "Shadow Contagion".#Tophacks:
– @ResolvLabs ($USR) De-peg: An AWS KMS breach enabled an 80M USR "infinite mint" (~$25M… pic.twitter.com/huohE79th6

— PeckShieldAlert (@PeckShieldAlert) April 1, 2026

Another exploit made headlines last week, whereby Drift Protocol lost more than $285 million on April 1. Investigators said the attacker drained vaults within about an hour after using Solana durable nonces to pre-sign transfers weeks earlier. Drift later opened on-chain talks with wallets tied to the exploit and linked the operation to a North Korean group.

The incident occurred as the firm posted business growth in 2025. The firm reported $127.8 million in revenue and said it ran 440,000 GPU containers across 94 countries. The platform serves artificial intelligence, gaming, and enterprise workloads through distributed infrastructure rather than centralized data centers. The network has also raised more than $140 million from investors, including Animoca Brands and HashKey.