Oraichain — ICS-20 EVM Precompile Unauthorized Mint (~1.51B ORAI)

August 8–9, 2026 — Oraichain's ICS-20 EVM precompile was exploited to mint approximately 1.51 billion unauthorized ORAI tokens, representing a ~98x inflation of the total supply.

Root cause (official Oraichain): 'Vulnerable ICS-20 EVM precompile minted the transfer amount instead of debiting the sender.' Every IBC transfer through the vulnerable path credited ORAI to the recipient without debiting the sender's balance, allowing unlimited token creation.

23:25–23:31 UTC, Aug 8: Exploit window — attacker executes IBC transactions through the vulnerable precompile, generating ~1.51B unauthorized ORAI.

23:31–04:00 UTC: Fund movement phase — unauthorized ORAI distributed across chains: - ~600M ORAI → Injective via IBC - ~57M+ ORAI swapped in OraiDEX liquidity pools - ~3,161 ATOM obtained via Cosmos Hub IBC - ~5,438 OSMO obtained via Osmosis IBC - ~3.9M ORAI across local intermediary accounts - ~200M ORAI staged in a fresh vault

04:00 UTC, Aug 9: Oraichain halts the network. Bridges, cross-chain routes, and public interfaces restricted. Exploit path identified and addressed. MEXC and KuCoin engaged to suspend ORAI deposits/withdrawals.

Aug 9–10: Team coordinates with partners and CEXs to limit fund movements and freeze unauthorized balances. Preparations begin to burn all unauthorized minted balances and reconcile protocol state.

Aug 10: @oraichain publishes official update confirming containment and recovery roadmap.

Aug 12: Oraichain reports on-chain restoration in progress.

As of Aug 20, 2026: No full post-mortem published. Attacker wallets not disclosed. Burn of unauthorized ORAI pending confirmation. Network restart timeline not announced.