HashKey Chain Admin Temporarily Swaps Contract to Move $142K in USDT
Admin moves 142,818 USDT via six-minute contract swap
The upgrade administrator for HashKey Chain moved 142,818 USDT (a stablecoin, a cryptocurrency pegged to the US dollar) from a user wallet on October 13 without that wallet signing a transaction on the network. The move was possible because the administrator temporarily replaced the chain's Ethereum deposit contract with custom code.
The swap lasted about six minutes before the original contract code was restored. Onchain records and analysis from L2Beat confirm the transaction details.
Key details from onchain data
- 142,818.278614 USDT was transferred from wallet 0x86e5...ec2a to address 0x0000000000000000000000000000000000000DA0 on Oct. 13 at 12:38:09 PM ET.
- The OptimismPortal2 contract, which passes messages between Ethereum and HashKey Chain, was switched to a custom implementation and then restored about six minutes later.
- L2Beat researcher donnoh_eth flagged the intervention on Oct. 15, noting the replacement could generate L2 transactions with any sender address.
- HashKey Chain has approximately $8 million in total value secured, according to L2Beat's dashboard.
How the swap worked
HashKey Chain is built on the OP Stack, a framework for creating layer-2 networks. In its normal state, the Portal contract derives the sender from the Ethereum account that calls it.
The temporary code replaced this behavior. It allowed the ProxyAdmin owner — the upgrade controller — to choose an arbitrary sender address using a function called depositTransactionOverride. The administrator supplied the user's address as the sender and directed the transfer toward the USDT contract.
Comments in the replacement code describe it as intended for emergency deposits. The reason for targeting this particular wallet remains unclear.
Multisig retains upgrade power after rollback
The upgrade controller is an NXV multisignature wallet requiring three of five signers. It can replace both the Portal and the L1StandardBridge without any delay period.
Restoring the original implementation removed the temporary override, but it did not remove the ability to install it again. L2Beat warns that users have no guaranteed window to exit their funds before an unwanted upgrade occurs.
What is confirmed
The contract swap occurred on Oct. 13. The USDT transfer was executed. The original contract was restored within approximately six minutes. The multisig upgrade controller remains in place with full authority to modify contracts.
What remains unclear
The reason for targeting this specific wallet is not explained. The absence of an L2 signature does not establish whether the account holder consented through another channel.
Why this matters for Layer 2 users
Deposit transactions on OP Stack chains rely on Ethereum deposit events for authorization rather than requiring a signature on the layer-2 network itself. This means an administrator with upgrade control can create deposits appearing to come from any address. For users bridging funds to HashKey Chain, the continuing risk is the administrator's upgrade authority over core bridging contracts.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.