I’m looking for some clarification regarding the IMA Bridge security incident from August 27.
Is there an official list of which tokens/assets were affected by the incident, and which SKALE chains were impacted?
For users who still hold bridged assets on SKALE chains, could you please clarify:
whether those assets are still fully backed;
whether any holders are expected to be reimbursed or made whole;
and when bridge withdrawals are expected to resume?
I haven’t seen a detailed post-mortem or a recent update since the initial announcement, so any clarification on the current status would be appreciated.
Quick update: I finally got a reply from SKALE support about the IMA Bridge incident. They said the investigation is still ongoing and asked affected users to fill out a form with their name, email, wallet address, affected amount, and the tokens involved. The form says this information will be used to assess affected accounts and possible recovery/reimbursement options. It also mentions that KYC/AML documents may be required before funds are returned, depending on regulatory requirements. They say a full post-mortem will be published once the investigation and security review are complete.
It seems like the Skale team have done a post mortem found at the following url. The one thing I would like to see is for the Skale team to have an external audit team do a review instead of an internal audit, which is what I read in the article. On the plus side, the Skale team knows what happened. The only thing left to hear back on is. 1) what was the final blast radius, 2) when will the IMA bridge be back online? and 3) an external audit. https://www.skale.space/blog/security-incident-update-skale-ima-bridge-update