ICON, the blockchain project behind the ICX token, said an attacker replayed valid withdrawal messages 1,492 times during a security incident on August 27, 2026. The repeated transactions drained millions of tokens from foundation-held wallets, but ICON said the confirmed net loss is much smaller than the raw figures imply.

A replay attack involves reusing an old, legitimate instruction as if it were new. In simple terms, it is similar to photocopying a signed check and cashing it repeatedly: the authorization is real, but the payment should only happen once. For related coverage, see Russia Expands Digital Ruble Access Through 12 Major Banks.

What Happened in the ICON Replay Incident

ICON said two previously legitimate signed withdrawal messages were replayed 1,492 times between 02:01:02 and 02:21:12 UTC on August 27, 2026, a window of roughly 20 minutes. For related coverage, see London Stock Exchange and Kraken Owner Payward Plan Tokenized UK Stocks Launch for 2027.

Of those attempts, ICON said 1,490 calls succeeded. The two messages had originally authorized real transfers, so the network treated each replay as a valid request.

According to ICON, the successful replays released 119,866,000 ICX and 531,600 bnUSD. Both assets came from foundation-held wallets rather than from ordinary users.

ICON stressed that no user deposits, balances, or positions were accessed or affected. Because the drained assets belonged to the foundation, regular ICX holders did not lose funds directly in the exploit.

Why the Headline Number Does Not Equal the Final Loss

The 119,866,000 ICX and 531,600 bnUSD figures represent what left the wallets during the attack, not the final damage.

ICON said the confirmed net loss so far is about 150.2 ETH plus 31,204 USDC. The 531,600 bnUSD exposure was fully recovered.

That distinction matters for readers trying to compare the event with the headline numbers. A large release figure can appear alarming, but recovery efforts, frozen funds, and asset conversions can reduce the actual loss significantly. The release figure should therefore be treated as the gross size of the incident, not the permanent loss.

The same distinction also explains why the ICX moved on-chain does not equal a permanent loss figure. ICON said much of the movement involved foundation assets that were tracked, contained, or clawed back in its post-mortem.

Markets reacted regardless. ICX was trading at about $0.0102899, down 26.33% over 24 hours, according to CoinGecko market data cited in the research.

How ICON and Exchanges Responded After the Exploit

ICON said its first monitoring alert fired at 02:08 UTC on August 27, 2026, minutes after the replay loop began.

Exchanges began suspending ICX deposits and withdrawals at 05:54 UTC, ICON said. The network itself was halted at 06:18:54 UTC and restarted at about 07:51 UTC on August 28, 2026.

Halting a blockchain is a blunt but effective response because it stops all transfers and prevents the attacker from moving more funds while a fix is prepared. In incidents like this, speed matters because once valid messages can be reused, every additional block or transfer window can widen the exposure until controls are tightened.

Exchanges also took precautionary measures. Bitvavo, a European crypto exchange, said ICX deposits and withdrawals were temporarily suspended on August 27, 2026 and were available again on August 31, 2026 after the incident was resolved.

"As a precaution, ICX deposits and withdrawals have been temporarily suspended. Trading remains available for now." Bitvavo Status

"As a precaution, ICX deposits and withdrawals have been temporarily suspended. Trading remains available for now." Bitvavo Status

ICON said legal counsel is engaging law enforcement and that freeze-and-preservation notices were sent to affected exchanges. As of September 1, 2026, no public regulatory filing has appeared.

For a regular ICX holder, the practical takeaway is straightforward: confirm that your exchange has restored ICX transfers before attempting to move funds, and follow ICON’s official channels for updates on recovery efforts and any law-enforcement action related to the case.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.