On February 21, 2026, ioTube bridge's Ethereum-side Validator contract private key was compromised via social engineering targeting an employee. The attacker performed a malicious upgrade bypassing validation and signature checks, gaining control of TokenSafe and MintPool. Approximately $4.3M in USDC, USDT, IOTX, WBTC, and BUSD were drained within hours. Attackers were credited to the same group behind the Infini exploit.