Cyvers Alerts has reported that the cross-chain bridge of Nervos Network, Force Bridge, may be vulnerable to hacking.

A post on X from Cyvers Alerts reported on the theft of 3 million USD from Force Bridge of Nervos Network, a decentralized bridge between Ethereum and Nervos. A suspicious address exploited the system, stealing assets such as 257.8K USDT, 539.09 ETH, and 898.3K USDC, and then laundered the money through Tornado Cash, a well-known cryptocurrency laundering service.

Force Bridge, as described on GitHub, relies on a multi-signature verification system to ensure safety, but this attack shows that there may be vulnerabilities in its smart contracts or governance, despite claims that the system would be secure if the majority of the mining power of Ethereum and Nervos remains honest.

Tornado Cash, used to obscure stolen funds, has a history of supporting money laundering, with its developer arrested in 2022 and a DAO hack in 2023 losing 900,000 USD, highlighting the ongoing risks in decentralized financial systems (DeFi).