In what seems to be a security breach, the Nervos Network’s cross-chain bridge, Force Bridge, has been reportedly taken over by a suspicious account, which has so far resulted in the theft of approximately $3 million in digital assets.
The breach is the latest incident where the vulnerabilities of a blockchain’s interoperability solutions have been exploited, raising concerns about the security of cross-chain protocols.
Magickbase and Cyvers sound the alarm about Nervos breach
One of the first alerts came from Magickbase, a developer of Nervos-integrated desktop wallet software. In a post shared on X (formerly Twitter), the team said it had picked up on unusual activity on Force Bridge and immediately shut down related services to protect users.
“We’ve detected abnormal activity on #ForceBridge and have paused the service as a precaution. Our team is investigating,” Magickbase wrote, assuring its users that more information would be shared as it becomes available.
Shortly after the post, blockchain security firm Cyvers Alerts published a more detailed breakdown of the breach. According to their analysis, a suspicious address has taken over the bridge and launched unauthorized movement of assets out of the Nervos network.
🚨ALERT🚨Our system has detected multiple suspicious transactions involving @NervosNetwork.
A suspicious address appears to have taken control over the bridge, stealing ~$3M in assets:
257.8K $USDT
539.09 $ETH
898.3K $USDC
60.4K $DAI
0.79 $WBTC
All funds were swapped to $ETH and… pic.twitter.com/jA3EZVpTeN— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) June 2, 2025
So far, the only communication from Nervos itself has been a repost of Magickbase’s initial warning.
According to Cyvers, the attacker converted the stolen tokens into Ethereum and began funneling the funds through Tornado Cash, a crypto “mixer” that scrambles transaction trails to make the origin and destination nearly impossible to trace.
This kind of laundering is all too familiar, and Tornado Cash has increasingly been used as a go-to tool for cybercriminals looking to clean stolen funds. And once the money hits Tornado, recovery becomes a long shot.
A bigger problem in the blockchain world
Unfortunately, this incident is just the latest in a growing pattern. Cross-chain bridges have become some of the most attacked pieces of infrastructure in the crypto ecosystem.
High-profile hacks like those on the Ronin and Binance bridges have made headlines; other exploits, like those involving Orbit Chain, Socket, and ALEX bridge, have also cost users millions of dollars over the past year.
Force Bridge was supposed to be part of Nervos Network’s broader vision of secure, scalable blockchain interoperability. The network has been widely praised in the past for its hybrid design, combining Bitcoin’s UTXO model with smart contract functionality.
In a 2024 Messari report, Nervos CKB was even called a potential “game-changer” for blockchain programmability. But as this breach demonstrates, even technically sophisticated networks are only as secure as their most exposed component.
This has also brought to light the ongoing debate surrounding the use of tools like Tornado Cash. The argument that it offers legitimate privacy benefits for users may not continue to hold water with its continuous use by bad actors to launder large amounts of stolen funds and complicate tracking efforts.
Want your project in front of crypto’s top minds? Feature it in our next industry report, where data meets impact.
