Multichain Collapse

On July 6, 2023, the cross-chain bridge protocol Multichain (previously known as Anyswap) experienced approximately $125 million in unauthorised withdrawals across its Fantom, Moonriver, Dogecoin and other bridge contracts. The incident sat on the line between "hack" and "rug pull" — and a Singapore court later concluded it was an inside job.

What happened

Multichain operated its cross-chain bridges using Multi-Party Computation (MPC) key sharding among a small team of operators. Trust in the bridge depended entirely on the integrity of the MPC participants and the secrecy of their key shares.

On May 21, 2023, Multichain CEO Zhaojun was arrested by Chinese police. In the weeks that followed:

• The remaining team announced they had lost access to the MPC servers — which Zhaojun apparently operated personally — and so could not authorise routine bridge transactions.
• Zhaojun's sister transferred remaining funds on the platform to two addresses she controlled, claiming "asset preservation".
• She was then also taken into custody by Chinese police, severing the team's last contact with her.
• On July 6, $125M in unauthorised withdrawals began flowing from the bridge contracts.

A Singapore court ruling in 2024 supported the view that the MPC keys had been controlled by Zhaojun alone and were used (by him or someone acting on his behalf) to drain the bridge — not stolen by an external attacker.

Aftermath

• Multichain announced it had ceased operations within a week of the unauthorised withdrawals.
• Affected protocols — Curve, Sushi, dozens of token issuers with wrapped assets on Multichain bridges — absorbed the losses or migrated wrapped representations to other bridge providers.
• No recovery; no public legal resolution of the underlying status of Zhaojun.

Why it matters

Multichain is the case study for operator-key risk in bridges: a bridge that depends on a single individual to operate the MPC ceremony has the same security model as that individual's life and freedom. The incident accelerated the broader industry move away from team-operated MPC bridges toward public attestation committees with explicit slashing (LayerZero, Across, CCIP) and canonical-execution bridges that do not rely on signers at all.