HashKey Chain Admin Moves 142,818 USDT With Temporary Contract Swap

HashKey Chain's upgrade administrator used a temporary replacement of its Ethereum deposit contract to move 142,818 $USDT from a user wallet without that wallet signing an L2 transaction, according to onchain records and L2Beat's analysis.

The L2 transaction transferred exactly 142,818.278614 $USDT from `0x86e5…ec2a` to `0x0000000000000000000000000000000000000DA0` on Oct. 13 at 12:38:09 p.m. ET.

Ethereum records show the chain's OptimismPortal2—a contract that passes messages between Ethereum and HashKey Chain—was switched to a custom implementation, then restored about six minutes later.

L2Beat's head of research, donnoh_eth, highlighted the intervention on Oct. 15, saying the replacement could generate L2 transactions with “any `from`.”

HashKey Chain is built on the OP Stack. In its normal implementation, the Portal derives the sender from the account calling it on Ethereum, applying an address alias for contract callers. The temporary code instead let the ProxyAdmin owner choose an arbitrary `_from` address using `depositTransactionOverride`.

The Ethereum call trace shows the administrator supplied the user's address as `_from` and targeted the $USDT contract. OP Stack's deposit specification explains why this works: deposit transactions rely on Ethereum's deposit events for authorization rather than an L2 signature.

Comments in the replacement code describe it as intended for emergency deposits. The reason for targeting this particular wallet remains unclear. The absence of an L2 signature does not by itself establish whether the account holder consented through another channel.

Rollback Leaves Upgrade Power Intact

L2Beat identifies the upgrade controller as an NXV multisignature wallet at `0x3228…C40f`, requiring three of five signers. It can replace both the Portal and the L1StandardBridge without a delay.

The chain, which announced a Morpho deployment agreement in July, had about $8 million in total value secured on L2Beat's dashboard on Oct. 15.

Restoring the earlier implementation removed the temporary override, but did not remove the power to install it again. For bridged funds, the continuing risk is the administrator's upgrade authority: L2Beat warns that users have no guaranteed window to exit before an unwanted upgrade.