Chiliz CEO Alexandre Dreyfus said in a security update that user funds and wallets were not affected in the incident, and total losses were limited to about 1 ETH, or roughly $2,000. He said the loss came from wallets used to pay cross-chain bridge fees, with no additional fund losses beyond that amount.
Dreyfus said the team discovered on Oct. 26 that an attacker had entered part of Chiliz’s internal infrastructure through an outdated legacy partner website. The company is continuing its review with an independent forensic firm.
Multisig, treasury systems and token minting were not compromised
According to Dreyfus, Chiliz’s multisig was not compromised at either the code or key level. He also said the company’s core smart contracts and treasury code were not altered.
Digital asset vaults, along with the minting of CHZ and fan tokens, were not affected, he said. About 1 ETH was taken from seven hot wallets used to pay cross-chain bridge fees, and the related transactions can be viewed publicly on Etherscan.
Encrypted user database was accessed, but no evidence of data export
Dreyfus said the attacker had access to an encrypted user database. At this stage, the company said there is no evidence that the data was exported, and no evidence that passwords or KYC files were exposed.
Regulators notified as bridge and governance portal were paused
Chiliz said it has notified regulators in line with GDPR and requirements related to the Malta Financial Services Authority and MiCA. The company has also rotated all keys and credentials.
In response, Chiliz paused its cross-chain bridge, revoked all relayers, and moved bridge wallets into institutional custody. The governance portal was also suspended as a precaution.
Dreyfus urged users not to share passkeys or recovery toolkits and to use only official channels.
