ICON Replay Exploit Hit 1,492 Withdrawal Messages

ICON, the blockchain project behind the ICX token, said an attacker replayed valid withdrawal messages 1,492 times during a security incident on August 27, 2026. The replays pulled millions of tokens out of foundation-held wallets, but ICON says the confirmed net loss is far smaller than the raw figures suggest. A "replay attack" means reusing an old, legitimate instruction as if it were new. Think of it like photocopying a signed check and cashing it over and over. The signature is real, but the payment should only happen once. For related coverage, see Russia Expands Digital Ruble Access Through 12 Major Banks. What Happened in the ICON Replay Incident ICON said two previously legitimate signed withdrawal messages were replayed 1,492 times between 02:01:02 and 02:21:12 UTC on August 27, 2026. That is a window of roughly 20 minutes. For related coverage, see London Stock Exchange and Kraken Owner Payward Plan Tokenized UK Stocks Launch for 2027. Replay attempts 1,492 ICON said the attacker replayed valid withdrawal messages 1,492 times in roughly 20 minutes. Of those attempts, ICON said 1,490 calls succeeded. The two messages had originally authorized real transfers, so the network treated each replay as a valid request. The successful replays released 119,866,000 ICX and 531,600 bnUSD, ICON said. Both assets came from foundation-held wallets, not from ordinary users. ICON stressed that no user deposits, balances, or positions were accessed or affected. Because the drained assets belonged to the foundation, regular ICX holders did not lose funds directly in the exploit. Why the Headline Number Does Not Equal the Final Loss The 119,866,000 ICX and 531,600 bnUSD figures describe what left the wallets during the attack. They do not describe the final damage. ICON said the confirmed net loss so far is about 150.2 ETH plus 31,204 USDC. The 531,600 bnUSD exposure was fully recovered. This gap matters. A large "released" number can look alarming, but recovery efforts, frozen funds, and asset conversions can shrink the actual loss dramatically. Readers should treat the release figure as the gross event size, not the permanent hole. The distinction also explains why the ICX drained on-chain does not equal permanent losses. Much of the movement involved foundation assets that were tracked, contained, or clawed back, according to ICON's post-mortem. Markets reacted anyway. ICX was trading at about $0.0102899, down 26.33% over 24 hours, based on CoinGecko market data cited in the research. ICX price $0.0102899 The research brief cites CoinGecko data showing ICX down 26.33% over the prior 24 hours. How ICON and Exchanges Responded After the Exploit ICON said its first monitoring alert fired at 02:08 UTC on August 27, 2026. That was minutes after the replay loop began. Exchanges began suspending ICX deposits and withdrawals at 05:54 UTC, ICON said.