Hackers Make Off With 124.4M RIO Tokens Across Five Blockchains

Realio has confirmed a security incident involving 124.4 million RIO tokens across five networks. The company said its web app, realio.fund, was compromised, prompting it to suspend access, freeze movements from client wallets, and keep the Algorand and Stellar bridges closed indefinitely. Realio added that the Freehold and Districts projects were not affected. Independent on-chain analysts flagged large, coordinated transfers on Ethereum, BNB Chain, Algorand, Stellar, and Realio's native network, with funds routed to addresses created only hours before the breach. Early indications point to compromised signature keys stored on the platform, rather than a smart contract exploit. Most of the tokens taken were not held in investors' wallets but in project reserves. Analysts reported withdrawals of 43.85 million RIO from the Algorand ASA vault and 69.87 million from the Stellar treasury—a combined 113.7 million tokens, representing 91.4% of the total stolen amount and a quantity described as previously unaccounted for in the token offering. User losses totaled 10.7 million RIO, equivalent to 3.27% of the circulating supply the day before the attack. The breakdown includes 5.73 million RIO taken from native-network accounts, 2.2 million from BNB Chain wallets, 2.12 million from Algorand and Stellar wallets, and 638,286 from Ethereum accounts, where the largest number of users were impacted. Despite the scale of the theft, low liquidity sharply limited realized proceeds. On Stellar's decentralized exchange, 2,976,145 RIO were sold in 533 trades for 115,296 XLM (about $21,900), as a thin order book amplified price declines during continuous selling. Trading on the Stellar exchange was halted for several hours. Of the 124.4 million stolen tokens, only 5,732,041 RIO have been sold so far on the native network, which is currently offline. The attackers still hold 68,220,776 RIO on Stellar and 43,409,824 RIO on Algorand. Separately, the TAC blockchain project team recently reported that unknown actors stole about $7.5 million from a single account by exploiting a flaw in a specific code component—the precompilation layer of the Cosmos EVM module.