ioTube Review 2026: IoTeX Bridge After the Exploit

ioTube is the cross-chain bridge for the IoTeX ecosystem. DefiLlama describes it as a decentralized bridge for moving tokens between IoTeX, Ethereum, BNB Chain and Polygon, and lists it since January 2022.

The homepage promotes 1:1 wrapped token bridging, a transaction explorer, and a user-friendly interface. It names Ethereum, BSC, Polygon and Avalanche among supported networks, although DefiLlama tracks only four chains.

The most important recent fact is security. Public reporting dated late February 2026 report that the Ethereum side of ioTube was exploited on February 21. Rekt News attributes it to a private key compromise that gave an attacker admin control, with about $4.4 million drained. Other coverage cites 410M CIOTX stolen, so figures vary by source.

Current TVL on DefiLlama is about $2.7 million, down 37.6% in seven days, which fits a bridge recovering from an incident. No audits are listed.

A bridge lets you use a token on a chain where it did not originate. On ioTube, you deposit a token on one network, and an equivalent wrapped token is made available on the other network at a 1:1 ratio. Unwrapping reverses the process and releases the original asset.

The bridge relies on contracts and administrative keys on each chain to mint, lock and release assets. That makes the security of those contracts and keys central to the safety of every bridged token.

The homepage says users can see all cross-chain transfers in ioTube Explorer. The project does not detail the validator or relayer setup behind the bridge.

The project does not publish a fee schedule for ioTube. The homepage only describes fees as low and confirmations as fast, with no figures.

In practice, bridge users typically pay gas on the source chain and may pay a bridge or relay fee. Any such amounts should appear in the bridge interface before you confirm a transfer.

ioTube has a reported security incident. Public reporting from February 2026 say the Ethereum side was exploited on February 21, and Rekt News attributes it to a private key compromise that gave an attacker full admin control and about $4.4 million drained. The project does not describe recovery, compensation or whether service has resumed in full.

DefiLlama lists no audits. Bridges carry smart-contract, key-management and wrapped-asset risk, and a compromised admin key is a reminder that those risks can be operational as well as code-related. Treat any bridged balance as exposed to the bridge's solvency.

ioTube suits existing IoTeX users who need to move tokens between IoTeX and Ethereum, BNB Chain or Polygon and who accept elevated bridge risk. It is a poor fit for anyone holding large balances or wanting a bridge with a clean, audited record.