The attacker allegedly reset the protocol’s LayerZero bridge peer configuration and forged a cross-chain message that created the fake tokens on Arbitrum. Within seconds, the assets were dumped through public liquidity routes, bypassing traditional smart-contract protections entirely.

The incident adds to a growing pattern across DeFi in 2026 where compromised deployer wallets and admin keys are becoming one of the industry’s biggest security risks. Analysts say the problem is no longer whether protocols pass audits, but whether critical operational permissions are protected by stronger multisig and governance safeguards.