x402

Arbitrum

GoPlus Security

USDC

Blockchain security firm PeckShieldAlert has reported a security breach targeting 402Bridge, a recently launched payment protocol built around the x402 mechanism, resulting in the theft of approximately $17,000 in USDC.
<figure class="wp-block-embed aligncenter is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> <a href="https://twitter.com/402bridge?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@402bridge</a> has been exploited. ~17K <a href="https://twitter.com/search?q=%24USDC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$USDC</a> was stolen. Please *Revoke* your allowance, if any, to 0xed1AFc4DCfb39b9ab9d67f3f7f7d02803cEA9FC5<a href="https://t.co/G07UxR0vYC" rel="noopener noreferrer nofollow">https://t.co/G07UxR0vYC</a> <a href="https://t.co/7LmDVIKIpD" rel="noopener noreferrer nofollow">https://t.co/7LmDVIKIpD</a>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1983029273528283503?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">October 28, 2025</a>
 </blockquote>
 </div>
</figure>
The incident, which affected more than 200 users, occurred just days after 402Bridge went live and quickly drew attention from the Web3 security community. PeckShieldAlert confirmed the exploit in a post on X, warning users to revoke any token approvals linked to the compromised contract address “0xed…9FC5.”
According to the 402Bridge team, the exploit originated from a critical design flaw in its backend process. The x402 protocol required users to sign or approve transactions via a web interface that relayed them to a backend server.&nbsp;
This server, which was connected to the internet, used an admin private key to execute contract methods, a setup that inadvertently exposed administrative privileges to attackers.
Blockchain investigators, including SlowMist founder Cos, identified the <a href="https://hash.media/hashdesk/bunni-dex-shuts-down-after-8-4m-hack-cites-lack-of-funds/" target="_blank" rel="noopener noreferrer nofollow">hacker’s</a> wallet address as “0x2b8F.” The attacker reportedly siphoned off $17,693 in USDC, converted the stolen funds into 4.2 ETH, and transferred them through Arbitrum via multiple cross-chain transactions to obfuscate the trail.
GoPlus Security also issued a warning on its Chinese social media account, alerting users to revoke authorizations associated with 402Bridge. The firm noted that the attacker exploited a function called “transferUserToken”, which enabled the unauthorized draining of USDC from user wallets that had previously granted approvals.
Security experts have since advised users to verify contract addresses before granting permissions, avoid unlimited token approvals, and routinely revoke unnecessary authorizations.
The 402Bridge breach underscores the persistent vulnerabilities in emerging cross-chain payment protocols, emphasizing the need for stronger backend security and key management practices in the fast-evolving decentralized finance ecosystem.
pay3 (pay3.so) is a crypto payment platform that replaces wallet addresses with usernames. Accept USDT, USDC, ETH, and BNB through one simple link: pay3.so/@yourname

402Bridge hacked days after launch, $17K in USDC stolen

Todayq News

Other articles published on Nov 5, 2025

Join our free newsletter for daily crypto updates!