Over $4.1M was drained across three incidents between April 6 and April 12, 2026: a cyberattack on Bitcoin Depot’s corporate wallets, an access control exploit on Aethir’s cross-chain bridge adapter, and a smart contract breach draining USDC from Denaria Finance on Linea.
This week’s Recoveris report covers the Bitcoin Depot cybersecurity breach that sent 50.9 BTC directly to a centralized exchange, the Aethir adapter exploit that leveraged Symbiosis Finance to bridge stolen funds to TRON, and the Denaria Finance contract vulnerability that drained $165K in USDC before the platform went offline.
Aethir – ~$423,000 | Smart Contract Exploit
On April 9, an attacker exploited an access control vulnerability in the AethirOFTAdapter contract on BNB Chain. Ownership of the adapter was changed at 02:37 UTC, granting the attacker immediate admin privileges to modify the contract and drain approximately 423,000 ATH tokens.
Following the drain, the attacker routed funds through multiple intermediate wallets and used Symbiosis Finance to bridge everything to the TRON network. As of April 10, the funds were split across two TRON addresses and held dormant, with no mixing or cash-out activity observed.
Aethir confirmed that the main ATH token contract on Ethereum and the ETH-ARB bridge remained unaffected. The team coordinated with Binance, Upbit, Bithumb, and HTX to blacklist attacker wallets and freeze any funds reaching those platforms. User losses were capped at under $90K, with a compensation plan forthcoming. The speed of the cross-chain transfer underscores the narrow window available for asset freezing once an exploit is executed.
Sources: Cryip, DEV Community Postmortem, Cointelegraph
Bitcoin Depot – ~$3,600,000 | Corporate Systems Breach
Bitcoin Depot disclosed in an SEC 8-K filing on April 6 that an unauthorized party gained access to its IT systems on March 23, transferring approximately 50.9 BTC from company-controlled wallets. The breach went undetected for three days before the company activated its incident response protocols.
On-chain analysis traced 54.45 BTC flowing directly to KuCoin. The routing to a single centralized exchange without intermediate obfuscation suggests either operational haste or confidence that the funds could be liquidated before intervention. The three-day detection gap is notable for a publicly traded company handling significant digital asset volumes.
When stolen funds land on a centralized exchange with minimal layering, the recovery window is narrow but viable. Swift coordination between forensic teams, legal counsel, and exchange compliance departments can result in account freezes before assets are withdrawn or converted. The direct KuCoin deposit represents one of the more actionable fund flows observed in recent weeks.
Sources: Infosecurity Magazine, Protos
Denaria Finance – ~$165,000 | Smart Contract Exploit
A smart contract vulnerability on Denaria Finance, a perpetuals protocol on Linea, was exploited on April 5 to drain approximately 165,600 USDC. The platform went offline immediately following the breach, pausing all user interfaces as a precaution.
The Denaria team initiated an investigation alongside Linea developers and auditing partners. An on-chain message was sent to the attacker offering a 15% bounty (approximately $25,600) for return of the remaining funds within 48 hours. A refund process for affected users with open trades and USDC Vault holdings is in development.
The negotiation approach, offering a bug bounty post-exploit, has become standard practice across DeFi. Its effectiveness depends heavily on whether the attacker has already begun laundering. Parallel forensic tracing ensures that if negotiations fail, the recovery effort is already underway.
Sources: Crypto Times
If your platform or users have been affected by recent exploits, immediate forensic intervention is critical to tracing and freezing assets before they reach obfuscation services.
