ICON Network Signature Replay Attack — ~150.2 ETH + 31,204 USDC Net

On August 27, 2026, between 02:01:02 and 02:21:12 UTC, an attacker executed a signature replay attack against ICON Network, replaying two legitimate withdrawal messages 1,492 times. This resulted in the minting of 119.866M ICX and 531,600 bnUSD, the large majority of which was subsequently frozen by the ICON Foundation. The confirmed net loss that reached attacker-controlled addresses was approximately 150.2 ETH plus 31,204 USDC. The network was halted for approximately 25 hours before resuming around 07:51 UTC on August 28. ICON's official post-mortem does not publish any attacker address. A separate AI-generated research report had fabricated three specific addresses purportedly linked to the incident; these have been independently confirmed as hallucinated and must not be reused.