Repeated ECDSA Nonce Lets Attacker Recover Private Key and Drain $7.9M From Anyswap's V3 Router

Cross-chain bridges took another hit as Anyswap became the second bridge exploited within a 24-hour span, alongside Chainswap.

Anyswap moved quickly to disclose what had happened:

An exploit was detected in the new anyswap v3 prototype, all bridge funds used in v1/v2 are safe. Remedial action already in place for all exploited funds.

Attacker's address: 0x0aE1554860E51844B61AE20823eF1268C3949f7C

The stolen funds, all denominated in dollar-pegged stablecoins, totaled approximately $7.9 million.

Just over 5.5 million MIM were taken in a single transaction, while three additional transactions accounted for roughly 2.4 million USDC combined:

1. Via Ethereum — 1,536,821.7694 USDC
2. Via BSC — 749,033.37 USDC
3. Via Fantom — 112,640.877101 USDC

The underlying flaw sat in how the prototype V3 Router implemented ECDSA, the signing algorithm underpinning its MPC wallet's private key generation. ECDSA's security depends on each signature using a fresh, unpredictable "k" value; if the same k value is reused across two or more signatures, the private key behind them can be mathematically reconstructed.

This is not a new discovery — the console-hacking collective fail0verflow documented the same weakness back in 2010 (slides here, pages 123–129), and its relevance to blockchain private keys was explained again in 2013. (Credit to Tayvano for flagging the connection here.)

Anyswap's own post-mortem confirmed that the attacker spotted a repeated k value across two V3 Router transactions on BSC and used it to derive the private key.

The team emphasized that only the new V3 cross-chain liquidity pools were impacted, and that V1 and V2 Routers continued operating normally. According to the post-mortem, the underlying code had already been patched, with V3 set to resume once a 48-hour timelock imposed by the team expired. Anyswap also said it would reward anyone reporting further bugs:

Anyswap will reward anyone who reports bugs to us. This will help us build truly secure and even better cross-chain solutions.

The episode underscores how difficult secure bridge design remains, even as capital increasingly spreads across multiple chains — a problem developers have yet to fully solve. Anyswap's V3 was explicitly a prototype, so some rough edges were expected, but the specific nature of this bug suggests the loss could have been avoided.

Ethereum developer Nick Johnson, while acknowledging that the team acted fast to stop further losses, argued the fix itself was inadequate:

Setting aside the fact that there's a much better, industry standard solution to this, their patch: Fails catastrophically (exposing users to another hack) if you accidentally delete a file, or restore from an old backup, or move to a new server.

And it requires every signature request to scan every previous one, but really that's the smallest problem here.

Given that critique from a well-known Ethereum developer, Anyswap's self-description as a "trustless protocol" may be a harder sell going forward. The patch itself remains public for anyone who wants to judge it firsthand.