AdsharesBridge exploit analysis
AdsharesBridge's verifier set still accepted a deprecated rotated-out key, and the attacker used that key to sign a destination burn. DeFiHackLabs reconstructs about $628K drained on Ethereum.
- Reported loss
- ~$628K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-15: Insufficient Validation on AdsharesBridge”.
Analysis1 min read
AdsharesBridge's wrapped-asset burn on the destination was signed by a verifier whose key-rotation history included a deprecated still-active key. The attacker used that deprecated key to sign a burn that the contract accepted as legitimate.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0x8844b4ec371c4b13d7fac701b5d546a7c2fba12621a9596dd14b662b14408789 on Etherscan for a total loss of about $628K. Defimon Alerts reported the incident.
What would have prevented it: removal of any key from the active set on rotation, with a grace period that does not allow deprecated keys to authorise new burns.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260515-adsharesbridge---deprecated-validator-key-accepted
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/AdsharesBridge_exp.sol
- https://etherscan.io/tx/0x8844b4ec371c4b13d7fac701b5d546a7c2fba12621a9596dd14b662b14408789
Other exploits
- TesseraSwap exploit analysis 18 May 2026
- SEAToken exploit analysis 17 May 2026
- VerusBridge exploit analysis 17 May 2026
- SQTokenStaking exploit analysis 12 May 2026
- HumaFinance exploit analysis 11 May 2026
- INKFinance exploit analysis 11 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
