Orbit Bridge incident, 2023-12-31

Orbit Bridge kept user deposits on Ethereum in a vault controlled by a 7-of-10 multisig. Seven valid signatures moved everything out, and from the chain's point of view these were legitimate withdrawals (Blockworks). Orbit's own statement says the cause was not a smart-contract vulnerability; it later pointed to security settings that a departing executive had allegedly weakened. We treat that account as Orbit's claim, not as an established fact (Orbit Chain).

Whatever the precise path, the attacker reached seven signing keys. That means the signers were not independent enough: either several keys sat on shared infrastructure, or one compromise gave access to many. A 7-of-10 threshold looks robust only if the ten keys are held by ten separately defended parties.

The incident also illustrates the "lock-and-mint" problem for ecosystems that depend on one bridge. Orbit-bridged stablecoins were widely used on Klaytn; once the vault was empty, those tokens' value depended entirely on whether anyone would make holders whole.

There is also a disclosure lesson. Orbit's explanation arrived weeks later and named an individual rather than a technical root cause. Bridges that publish a dated, technical post-mortem quickly — as Across and NEAR Intents did in 2026 — give users and integrators something to verify; an account that cannot be checked leaves holders unable to judge whether the same weakness remains.

At the time

Holders of Orbit-bridged stablecoins had no way to stop the drain; the protective step afterwards was to stop accepting those tokens at face value and to avoid DeFi pools pricing them at $1 until Orbit published a recovery plan.

Now

When a stablecoin on a chain is a bridged version, find out which bridge issued it and how that bridge is secured. Prefer issuer-native versions (for USDC, Circle's native token via CCTP) over lock-and-mint wrappers, and check signer independence for any multisig bridge you use.