Hackers Drain 124.4 Million RIO from Five Blockchains; Realio Confirms Breach

4

Hackers drained 124.4 million RIO from wallets across five blockchains

Thieves stole 124.4 million RIO tokens from wallets and user accounts controlled by Realio across five blockchains. Security experts at realiostats.com estimated the attacker’s proceeds at approximately $234,000, against a nominal value of the stolen assets at $6.3 million.

Realio confirmed the attack, stating that the web application realio.fund was compromised, access to the platform was halted, and fund movements in client wallets were blocked. The Freehold and Districts projects were unaffected, while the Algorand and Stellar bridges will remain closed indefinitely.

Independent blockchain researchers recorded mass transfers on Ethereum, BNB Chain, Algorand, Stellar, and the native Realio network. Transactions were sent to addresses created just hours before the attack. The incident is believed to be linked to the compromise of signing keys stored on the platform, rather than a smart contract exploit.

A significant portion of the stolen funds was not in free circulation within investor wallets but was held in blockchain reserves. From the Algorand ASA treasury, 43.85 million RIO were drained, and from the Stellar treasury, 69.87 million. In total, this amounts to 113.7 million tokens, or 91.4% of the total theft volume—a quantity that was previously not accounted for in the token’s supply.

Users lost 10.7 million RIO, representing 3.27% of the circulating supply the day before the attack. This includes 5.73 million RIO drained from native network accounts, 2.2 million from BNB Chain wallets, 2.12 million from Algorand and Stellar wallets, and 638,286 tokens from Ethereum accounts, where the largest number of users were affected.

Due to low liquidity, the hackers’ proceeds amounted to only 3.7% of the nominal value of the stolen assets. For example, on the Stellar decentralized exchange, 2,976,145 RIO were sold in 533 trades for just 115,296 XLM ($21,900). The order book was too thin: continuous selling drove the price down faster than orders could be executed. Trading on the Stellar exchange was suspended for several hours.

Of the 124.4 million stolen tokens, only 5,732,041 RIO have been realized on the native network, which is currently halted. The attackers still hold 68,220,776 RIO in the Stellar network and 43,409,824 RIO in Algorand.

Recently, unknown actors stole approximately $7.5 million from a single account on the TAC blockchain, according to the project team. The hackers exploited a vulnerability in a specific code component—the precompiled layer of the Cosmos EVM module.