Aethir Contains Bridge Exploit, Limits User Losses to Under $90K

Aethir announced that it detected and contained a malicious exploit targeting its ATH bridge contracts, limiting total user losses to under $90,000 while keeping the main ATH token supply on Ethereum intact [1].

Key takeaways

• The bridge exploit was isolated and the compromised contracts were disconnected within hours of detection [2].
• User losses were capped at under $90,000, far below the $400,000 initially estimated by PeckShield [3].
• Major exchanges—including Binance, Upbit, Bithumb and HTX—blacklisted attacker wallets, helping to freeze the stolen funds [1].
• A full compensation plan and a list of attacker wallets will be posted on Aethir’s Discord next week [4].
• The incident underscores growing “shadow contagion” risks in DeFi, where a single breach can affect multiple linked platforms [2].

Rapid Response Contained the Bridge Attack

Aethir’s security team flagged anomalous activity on the ATH bridge contracts that connect Ethereum with other chains on March 21, 2025. Within minutes, the team disconnected the affected contracts, preventing further movement of assets and preserving the core ATH token contract on Ethereum [5]. The platform confirmed that the ETH‑ARB bridge on Squid was not impacted, and the main ATH supply remained untouched [1].

Initial analysis by blockchain security firm PeckShield suggested the attacker had moved funds from BNB Chain to Tron, estimating potential losses around $400,000 [1]. Aethir’s own monitoring, however, reported that the actual user losses stayed below $90,000, a figure later reiterated by multiple outlets [3]. The discrepancy highlights the challenges of real‑time loss accounting during fast‑moving exploits.

Exchanges and Security Partners Help Freeze Funds

Aethir credited several exchanges for swift action in blacklisting wallets linked to the exploit. Binance, Upbit, Bithumb, and HTX each blocked identified addresses, limiting the attacker’s ability to cash out the stolen assets [1]. The Web3 security platform ZeroShadow also provided analysis that aided the investigation, according to Aethir’s update [2].

The company pledged to publish a detailed memo on Discord, outlining the incident, the affected users, and the forthcoming compensation mechanism. A full list of attacker wallets will also be shared, and Aethir said it is cooperating with authorities to trace and recover the funds [4].

Why it matters

The Aethir episode illustrates both the persistent threat of cross‑chain bridge attacks and the importance of rapid, coordinated response. While bridge exploits have historically resulted in multi‑million‑dollar losses, Aethir’s swift containment kept damages under $90,000, offering a rare case study in effective crisis management [5]. The incident also reinforces the “shadow contagion” pattern noted by PeckShield, where a single breach can ripple through interconnected DeFi protocols, stressing liquidity and lending markets [2]. As Aethir prepares its compensation plan and post‑mortem, the broader crypto community will watch how the firm’s remediation efforts influence best practices for bridge security and incident response.