Rubic 2022 RBC/BRBC bridge wallet compromise
A private key for an administrative wallet used by Rubic's former RBC/BRBC bridge and staking rewards was compromised. Rubic reported that approximately 35 million RBC/BRBC were sold and that the former native bridge had already been disabled and replaced by an external bridge.
Incident facts
- Incident title
- Rubic 2022 RBC/BRBC bridge wallet compromise
- Bridge
- Rubic
- Incident date
- 2022-11-02
- Incident type
- Abnormal Transfers
- Major incident
- Yes
- Affected chains
- Ethereum, BNB Chain
- Affected assets
- RBC, BRBC, ETH
- Attack category
- Operator Or Governance Issue
- Reported loss
- 35 million RBC/BRBC sold; approximately 138 ETH proceeds reported
- Recovery
- Unknown
- Reimbursement
- Not Applicable
- Restart
- Replaced
- Current outcome
- Deprecated After Incident
- Resolution
- Unresolved
- Last reviewed
- 2026-07-28
- Last verified
- 2026-07-28
Timeline events
Rubic native RBC/BRBC bridge disabled2022-10
Rubic reported that its native RBC/BRBC bridge was disabled at the end of October and replaced in practice by an external bridge solution.
RBC/BRBC bridge wallet compromise occurred2022-11-02
Unauthorized actions using a compromised administrative-wallet private key released assets associated with the former RBC/BRBC bridge.
Rubic disclosed token sales and attacker proceeds2022-11-04
Rubic reported approximately 35 million RBC/BRBC sold and approximately 138 ETH proceeds remaining in the marked attacker wallet.
Rubic announced tokenomics relaunch after collateral break2022-11-29
Rubic stated that the additional RBC supply broke the RBC/BRBC collateral relationship and proposed relaunching the token with new tokenomics.
Evidence records
- Rubic Weekly Report 11/04/2022Rubic · Tier 1 · 2022-11-04
- Introducing the New Rubic Tokenomics — The Way ForwardRubic · Tier 1 · 2022-11-29
- Cross-chain bridge RBC — BRBC and BRBC tutorialRubic · Tier 1 · 2021-03
- November 2022 Kickstart with USD 32+ Million in DeFi HacksQuillAudits · Tier 2 · 2022-11
Known unknowns
- The exact USD value realized across all token sales is not established.
- The former bridge was already disabled before disclosure, but the exact final disablement day is reported only as the end of October.
- User swap and staking funds were reported safe; this record does not infer user reimbursement.