The most instructive post-mortems are the ones where nothing exotic happened — no key compromise, no oracle manipulation, no flash-loan gymnastics — just two parts of the same withdrawal path disagreeing about what makes a message unique. That is the whole of the ICON Network incident, documented in the ICON Foundation's post-mortem of the August 27 exploit.
What Happened
Between 02:01:02 and 02:21:12 UTC on August 27, an attacker resubmitted two previously legitimate, signed withdrawal messages to the SODAX Asset Manager contract 1,492 times over roughly 20 minutes. Within each replay set, the signed payload and signature were identical byte for byte. Only the unsigned high bits of each message's serial number varied — and 1,490 of the 1,492 calls succeeded.
The replays released 119,866,000 ICX and 531,600 bnUSD into a single attacker-controlled wallet, far beyond what the original signed messages authorized. All assets involved were foundation-held; the post-mortem states that no user deposits, balances or positions were accessed.
The root cause, per the foundation, was a change intended to standardize withdrawal message data to a fixed 32-byte size. That change introduced an integer-precision defect: part of each message's serial number was handled through float64-range logic rather than exact integer arithmetic. In practice, the contract's uniqueness guard — the check meant to stop a message from being processed twice — validated only the high bits of the serial number, while the portion actually covered by the cryptographic signature (the low 256 bits) never changed between calls. Vary the unsigned high bits, pass the guard, and the signature check still sees the same two authorized messages.
Losses and Containment
The confirmed damage so far is narrower than the headline release. Most of the exploited ICX moved to exchange deposit addresses, and the foundation says it believes most of it remains frozen within a couple of exchanges, with recovery efforts underway. Confirmed as taken: approximately 150.2 ETH, converted and withdrawn to Ethereum before controls fully took hold, plus 31,204 USDC borrowed against the exploited ICX and bnUSD as collateral. The 531,600 bnUSD exposure has been fully recovered, per the post-mortem.
The response had two stages. A monitoring alert fired within seven minutes of the first exploit transaction — but staff noticed the anomaly later, and the affected contract was paused only after that human recognition. The network itself, controlled by the foundation during the token migration period, was then halted outright. A portion of the ICX was converted and withdrawn as ETH during the hours between the contract-level pause and the full halt, the post-mortem acknowledges; exchanges holding affected deposits were formally notified and asked to halt withdrawals and preserve records. The network resumed at approximately 07:51 UTC on August 28, about 25 hours after the halt.
Per the timeline as summarized by CryptoSlate, the gap between the first alert (02:08 UTC) and the opening of a human investigation (around 03:40) ran roughly 90 minutes; ICON attributed it to alert tuning — that alert class had produced false positives during unrelated connectivity incidents and did not page the on-call engineer. Detection worked; escalation didn't.
The Boundary Two Reviews Never Crossed
The audit history here is not a story of negligence. The migration contract underwent a third-party audit, and the foundation says all recommendations were applied — including modifications to this exact area of code. The relay logic received a dedicated review; the SODAX audit archive lists eight reports across components, including a November 2025 relay audit. Yet the precise mismatch between the uniqueness check and the signed value fell outside those findings, the foundation acknowledges: "our efforts still fell short."
Two lessons generalize. First, replay resistance is a property of a path, not a contract: both ends of a withdrawal flow must agree on exactly which bits make a message unique and which bits the signature commits to. No single-component review will surface that disagreement. Second, a seven-minute detection means little if the escalation path treats the alert as noise — false-positive fatigue is an incident-response vulnerability in its own right.
This case is a concrete instance of the audit-scope problem quantified in the ack3 H1 2026 study we cover today: reviewed code failing at a boundary no review was scoped to cross.