ICON, the blockchain project behind the ICX token, said an attacker replayed valid withdrawal messages 1,492 times during a security incident on August 27, 2026. The replays pulled millions of tokens out of foundation-held wallets, but ICON says the confirmed net loss is far smaller than the raw figures suggest.
A “replay attack” means reusing an old, legitimate instruction as if it were new. Think of it like photocopying a signed check and cashing it over and over. The signature is real, but the payment should only happen once. For related coverage, see Russia Expands Digital Ruble Access Through 12 Major Banks.
What Happened in the ICON Replay Incident
ICON said two previously legitimate signed withdrawal messages were replayed 1,492 times between 02:01:02 and 02:21:12 UTC on August 27, 2026. That is a window of roughly 20 minutes. For related coverage, see London Stock Exchange and Kraken Owner Payward Plan Tokenized UK Stocks Launch for 2027.
Of those attempts, ICON said 1,490 calls succeeded. The two messages had originally authorized real transfers, so the network treated each replay as a valid request.
The successful replays released 119,866,000 ICX and 531,600 bnUSD, ICON said. Both assets came from foundation-held wallets, not from ordinary users.
ICON stressed that no user deposits, balances, or positions were accessed or affected. Because the drained assets belonged to the foundation, regular ICX holders did not lose funds directly in the exploit.
Why the Headline Number Does Not Equal the Final Loss
The 119,866,000 ICX and 531,600 bnUSD figures describe what left the wallets during the attack. They do not describe the final damage.
ICON said the confirmed net loss so far is about 150.2 ETH plus 31,204 USDC. The 531,600 bnUSD exposure was fully recovered.
This gap matters. A large “released” number can look alarming, but recovery efforts, frozen funds, and asset conversions can shrink the actual loss dramatically. Readers should treat the release figure as the gross event size, not the permanent hole.
The distinction also explains why the ICX drained on-chain does not equal permanent losses. Much of the movement involved foundation assets that were tracked, contained, or clawed back, according to ICON’s post-mortem.
Markets reacted anyway. ICX was trading at about $0.0102899, down 26.33% over 24 hours, based on CoinGecko market data cited in the research.
How ICON and Exchanges Responded After the Exploit
ICON said its first monitoring alert fired at 02:08 UTC on August 27, 2026. That was minutes after the replay loop began.
Exchanges began suspending ICX deposits and withdrawals at 05:54 UTC, ICON said. The network itself was halted at 06:18:54 UTC and restarted at about 07:51 UTC on August 28, 2026.
Halting a blockchain is a blunt but effective tool. It stops all transfers, which prevents an attacker from moving more funds while a fix is prepared.
Exchanges took precautionary steps too. Bitvavo, a European crypto exchange, said ICX deposits and withdrawals were temporarily suspended on August 27, 2026 and were available again on August 31, 2026 after the incident was resolved.
“As a precaution, ICX deposits and withdrawals have been temporarily suspended. Trading remains available for now.”
Bitvavo Status
These kinds of exchange pauses are becoming a standard response across the industry, much like how platforms adjust around major regulatory shifts such as Russia’s new crypto law or new product rollouts like Binance’s settled options tied to US stocks.
ICON said legal counsel is engaging law enforcement and that freeze-and-preservation notices went to affected exchanges. As of September 1, 2026, no public regulatory filing has appeared, a reminder that enforcement often lags policy debates like the SEC and Senate crypto frameworks.
For a regular ICX holder, the practical takeaway is simple. Check that your exchange has restored ICX transfers before trying to move funds, and watch ICON’s official channels for updates on the remaining recovery and any law-enforcement action tied to the case.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
