SlowMist Cosine: The 402Bridge attack appears to have originated from a private key leak, and the possibility of insider involvement cannot be ruled out.

According to SlowMist Cosine analysis, the attack on the cross-chain bridge project 402Bridge appears to have originated from a private key leak, and the possibility of insider involvement cannot be ruled out. The 402bridge.fun domain name ceased service just two days after registration. The attacker's address profited approximately 4.2 ETH and has since transferred the stolen funds to the Arbitrum network. Currently, no further movement of the stolen funds has been observed. This is the first public security incident involving 402 Protocol-related services.