TimeBridge Exploit — Full Transparency Update On 22 April 2026, the legacy TimeBridge was exploited through a cross-contract signature replay. We owe the community a straight account of what happened, what we lost, and how we are making it right. What happened The attacker used validator-signed messages from the CGU (Polygon) bridge and replayed them against the TIME (BSC) contract — the two contracts shared an identical message digest scheme and the same validator signer set. The BSC TIME contract accepted the signatures and minted TIME that was never locked on the source side. Two fraudulent mints, both on BSC: • 50,000 TIME — 12:59:37 UTC — tx • 469,000 TIME — 13:23:59 UTC — tx Total fraudulent mint: 519,000 TIME (~$872K notional). Attacker EOA: 0x80725752602613d05eEC48d6B79ABc54cC4aF424 What the attacker actually realised Both tranches were dumped into the PancakeSwap TIME/WBNB pool with heavy slippage. Gross proceeds to the attacker were 96.2 BNB (≈ $61,142) — roughly 7% of the notional they printed. About 46.21 BNB was bridged to Base via Relay; the remainder is dust. TIME supply on Ethereum and Polygon is unaffected. The incident is contained to the BSC contract. Root cause (short version) The BSC TIME mint digest was built as keccak256(abi.encodePacked(recipient, fromChainId, toChainId, lockId, amount)) — it did not include the contract address or an EIP-712 domain separator. The CGU Polygon bridge used the identical schema with the same signer set, so a valid CGU burn signature was bitwise-identical to a valid TIME mint signature. The attacker provoked the validators to sign CGU burns and submitted those signatures to TIME. The legacy TimeBridge has been decommissioned. How we are making this right There is no treasury reserve equal to 519,000 TIME. We are not pretending otherwise. Instead we are committing to a mechanical, on-chain buyback-and-burn program funded by new LaborX revenue. LaborX is pivoting to become the execution layer for AI agents — a marketplace where AI agents post tasks and verified humans complete them, with on-chain escrow. Current user base: 586K active users, 65.3% YoY. First product deliverable — an MCP server — ships within ~90 days. The program: • Phase 1 — Remediation. 20% of gross AI-agent platform revenue → open-market TIME buybacks, burned to 0x…dEaD, executed weekly. Continues until the full 519,000 TIME is retired. • Phase 2 — Permanent. Rate steps down to 10% of gross AI-agent revenue, in perpetuity, as a standing tokenomic feature. • Weekly on-chain buyback burn tx hashes, public dashboard at burn.chronotech.io, quarterly third-party attestation by a licensed accounting firm. No migration. No swap. No fork. No snapshot. TIME stays TIME. Honest framing: the program activates once real AI-agent revenue exists — target window is month 4–6 from announcement. We are not committing a dollar figure today. We are committing to mechanics, on-chain transparency, and a token-denominated target of 519,000 TIME retired. Bridge rebuild Any future cross-chain TIME movement will use a third-party framework (LayerZero / Wormhole / Axelar class), with EIP-712 typed data, m-of-n validator threshold, per-epoch mint caps, and an independent tier-one audit. Re-enablement is audit-gated, not calendar-gated. We will publish weekly progress updates in this channel from the moment Phase 1 activates. No theatre, just tx hashes. — ChronoTech team