PIR-2026-0037 - 402Bridge private-key leak drains USDC approvals from 227 wallets in the x402 agent-payment ecosystem

• id: PIR-2026-0037
• title: Leaked admin key lets attacker seize the 402Bridge contract and drain $17,693 in USDC from 227 approving wallets in ~28 minutes
• date_occurred: 2025-10-27/28 (sources split between Oct 27 UTC and "early morning Oct 28" in UTC+8 community alerts; drain window ~28 minutes - see Verification notes)
• date_detected: same night (GoPlus community alert on abnormal transfers)
• date_disclosed: 2025-10-28 (team confirmation + security-firm analyses)
• status: corroborated (on-chain record + team confirmation + independent analyses)

The agent

• agent_description: 402Bridge, a third-party cross-chain bridge serving Coinbase's x402 agentic-payment ecosystem; users and agents had granted the bridge contract USDC spending approvals. Boundary case: no LLM in the failure path - the failure sits in payment infrastructure that agent workflows depend on.
• operator_type: startup (small third-party team)
• autonomy_level: n/a (no agent autonomy in the failure path)
• model_stack: none
• harness: n/a (smart contract + admin key custody)

Authority

• authority_scope: funds (USDC approvals from every wallet that had authorized the contract; the admin key controlled contract ownership)
• funds_at_risk_usd: all outstanding user approvals (unquantified; realized subset was $17,693)
• blast_radius: customers/third parties (227 user wallets)

The failure

• root_cause: credential-exposure (primary; admin private key); contributing operator-error (key custody + permission design that let an ownership transfer unlock transferUserToken against user approvals)
• failure_locus: dependency (third-party infrastructure in the agent-payment stack, not agent reasoning)
• mechanism: The project's private keys leaked - the team confirmed more than a dozen test and main wallets were compromised. The attacker used the leak to transfer ownership of the bridge contract to their own address, then called transferUserToken against every wallet with an active approval, draining $17,693 in USDC from 227 wallets in ~28 minutes before swapping to ETH and bridging to Arbitrum. SlowMist attributed the breach to key leakage plus permission mismanagement and explicitly could not rule out an insider.
• adversary_present: yes
• exploitation_status: in-wild-exploited

Impact

• severity: loss
• direct_loss_usd: 17,693 (on-chain, consistent across sources)
• indirect_loss_usd: unknown (project defunct; user approval-revocation effort)
• downtime: total - project halted all operations; website went offline
• data_exposure: none (funds only)

Detection and recovery

• detected_by: automated-monitor / third-party (GoPlus community alert; SlowMist post-incident analysis)
• time_to_detect: hours at most (alert the same night as the drain)
• time_to_recover: no recovery - funds not returned; team reported to authorities
• remediation: operations halted; users urged to revoke approvals
• structural_fix: none from the project (defunct); ecosystem takeaway is approval hygiene for agent-payment contracts
• controls_that_worked: third-party on-chain monitoring surfaced the drain fast; nothing bounded the loss by design - the ceiling was the small scale of outstanding approvals, which is luck, not a control

Legal

• liability_holder: 402Bridge team (self-acknowledged key-custody failure; insider question open); no known proceedings beyond the team's report to authorities
• precedent_set: none
• sealed_material: no

Evidence

• telemetry_grade: append-only (on-chain record of the drain and fund movement; team/firm narratives layered on top)
• sources:
• https://crypto.news/402bridge-hack-leads-to-over-200-users-drained-of-usdc/ (independent)
• https://protos.com/402bridge-private-key-leaks-227-wallets-drained-in-minutes/ (independent)
• https://forklog.com/en/402bridge-loses-over-17000-usdc/ (independent)
• https://www.panewslab.com/en/articles/17ffaa3c-2beb-4cd3-b95c-33e26af7567c (SlowMist statement)
• https://superex.medium.com/the-explosion-of-the-x402-protocol-and-the-402bridge-security-incident-an-in-depth-analysis-of-12c909bed5f1 (analysis)
• Independence: good - multiple outlets plus two security firms; team statements corroborate.
• confidence: high on figures and mechanism (on-chain); medium on attribution (external leak vs insider unresolved)

Verification notes

1. Date corrected from a flat 2025-10-28 to 2025-10-27/28: ForkLog and others date the attack Oct 27, while first alerts are timestamped "early morning Oct 28" in UTC+8 community channels - a timezone artifact the candidate record flattened. Stated as a range with the conflict named.
2. The candidate's claim that the incident preceded a ~77% collapse in x402 volume from a Nov 2025 peak was not independently verified here and is omitted.
3. Added SlowMist's explicit refusal to rule out an insider; the candidate carried only "private-key-leak attribution is from post-incident analyses."