A cross-chain bridge team has published a post-mortem attributing last week's loss to the compromise of a validator signing key that had been in continuous use since the contract was deployed, despite an internal policy requiring quarterly rotation.
The report is unusually candid about the gap between the documented process and the operational reality, and names the specific control that failed rather than describing a "sophisticated attack".
On-chain movement of the funds stopped at a mixing service. The team has posted a recovery address and is coordinating with two exchanges on attribution.
Two audits of the bridge were published before the incident. Neither covered key management, which is a recurring blind spot: audits scope contracts, and losses increasingly come from the operational layer around them.
Loss figures in this article are taken from confirmed on-chain transfers, not from the team's initial estimate, and will be revised publicly if the confirmed total changes.
