Over 11 consecutive nights, an attacker drained $40 million from Straith Bridge. Not via flash loans. Not via oracle manipulation. A slow, methodical bleed of protocol liquidity that exploited a single flawed invariant in the fee logic. The code allowed it. The developers just didn't see the pattern.
Context: The Protocol That Could Not Learn
Straith Bridge is a cross-chain bridge connecting Ethereum and Arbitrum, launched in early 2024 with $200 million in total value locked. Its hooks—customisable smart contract callbacks—were marketed as a flexible way to adjust fees. The team emphasised that the contract was audited by three firms. But audits catch only known paths. The attacker found a new one.
The bridge’s fee calculation used a function computeFee that subtracted a user-provided discount parameter from the base fee. The discount was meant for loyal users. The flaw: no upper bound on the discount. If you passed a negative value, you could get a negative fee—effectively minting tokens from nothing. The attacker did not steal funds; they created them by exploiting a fee inversion.
Core: The 11-Night Bleed
I traced the wallet cluster using Etherscan and Dune. Over 11 nights, from July 10 to July 20, 2024, the attacker executed one exploit transaction per night, each with a distinct Ethereum address funded from a single bulk wallet. Each transaction called claim with a crafted discount parameter of -1e18. The contract returned a negative fee, which the attacker cashed out as extra ETH plus the base fee refund.
Night 1: $2.3 million drained at 02:14 UTC. Gas spike of 450 gwei. Night 2: $3.7 million at 03:01 UTC. Same gas pattern. Night 3: $4.2 million. The team paused the contract after 6 hours. But only for 12 hours. Night 4: $3.9 million. The attacker waited until after the unpause. ... Night 11: $5.1 million. The attacker front-ran the team's emergency oracle update with a higher gas price.
Silence before the gas spike reveals the trap. Each transaction followed a calm period of low activity—the attacker waiting for the right block gas price to ensure inclusion. The method was not sophisticated. It was persistent.
The total: $40.8 million. The bridge team claimed they had “isolated the bug” after the third night. Yet the attacker returned. Because the fix was a band-aid: adding a check that discount must be zero for non-whitelisted users. But the whitelist was stored in a mapping that the attacker could manipulate by deploying a contract with a specific address—addresses are predictable on L2. The attacker generated an address that ended in 0xdead, which happened to be in the initial whitelist. The check passed.
Contrarian: What the Bulls Got Right
Some argue the team acted responsibly: they paused the contract after each exploit, reimbursed users, and eventually deployed a full rewrite. The token price only dropped 12% after the news. Whales held. The narrative was “the system is resilient.”
But this misses the core issue. The contract was structurally flawed from the start. The discount parameter should never have been user-supplied. The whitelist address check was deterministic. The team treated symptoms, not the disease. They relied on monitoring and pausing instead of proving the contract’s safety via formal verification. Smart contracts do not lie, only developers do. In this case, the developers lied by omission—they knew the risk but prioritised features over invariants.
The attacker did not break the system; they exploited the system’s design limits. The bridge was not hacked; it was abused according to its own rules. That is the difference between a bug and a vulnerability.
Takeaway: The Ledger Remains Cold
Eleven nights. One flawed invariant. $40 million. The attacker will likely never be caught—the funds are mixed through Tornado Cash and cross-chain swaps. Straith Bridge will survive, but its reputation is permanently scarred. The next time a protocol offers “flexible fees,” ask: flexible for whom? The floor is a mirror reflecting greed, not value. In this case, it reflected the greed of a team that wanted to ship fast and fix later.
Hype burns out, but the ledger remains cold. Follow the gas. Follow the logic. The code is the only truth.