Realio Network suffers $6.2M attack on August 25; 127.9M RIO stolen

ME News reports that, on August 27 (UTC+8), according to GoPlus monitoring, the RWA tokenization and management platform Realio Network was attacked on August 25. The attacker compromised the platform’s signing stack and drained treasury and custodial wallets across five blockchains: Ethereum, BNB Chain, Algorand, Stellar, and the Realio native chain. A total of 127.9 million RIO tokens, valued at approximately $6.2 million, were stolen, and the attacker has already cashed out around $317,000. GoPlus Security analyzed that the root cause was the compromise of the platform’s signing key. Previously, realio[.]fund used a single hot signer to manage treasury, reserve, and user custodial sub-accounts. After gaining access to this key, the attacker was able to directly sign transfers across multiple chains without requiring user approval, key reconfiguration, or exploiting any smart contract vulnerabilities. Realio’s official team has suspended all platform access, halting all deposits and withdrawals. The team is currently developing a recovery plan and verifying the details of the incident, and will cooperate with law enforcement to identify the attacker. (Source: BlockBeats)