Multichain

Summary

Multichain (launched in July 2020 as Anyswap) was, at its peak, the largest cross-chain bridge in crypto, connecting more than 80 blockchains and routing billions of dollars in wrapped assets. It used a multi-party computation (MPC) network of nodes to custody locked assets and mint equivalent wrapped tokens on destination chains, positioning itself as more decentralized than federated multisig bridges. The protocol quietly depended on a single point of failure: its founder and CEO, known publicly as Zhaojun, who according to the team controlled the operational keys to the MPC infrastructure from the project's inception. In May 2023 he was taken into custody by Chinese police and went silent; by July 2023, roughly $126 million in user and protocol funds had moved out of Multichain's contracts on Fantom, Moonriver, and Dogechain under mysterious circumstances, and the project confirmed it was ceasing operations after Zhaojun's sister was also detained.

Design (Mechanism)

Anyswap launched in 2020 as a cross-chain DEX and swap protocol built on Fusion's DCRM (distributed control rights management) technology, before dropping its DEX function in early 2021 to focus purely on bridging, rebranding as Multichain in mid-2021. Its core mechanism was lock-and-mint: a user deposits an asset into a Multichain smart contract on the source chain, and an MPC network of off-chain nodes collectively verifies the deposit and signs a mint transaction that creates a wrapped equivalent on the destination chain (burn-and-release worked in reverse). The MPC design split the private key material controlling bridge funds across multiple nodes/parties using threshold signature schemes (later "fastMPC"), intended to remove any single custodian from being able to unilaterally move funds. Multichain also ran liquidity "router" pools that let some assets swap directly rather than through wrap/unwrap, and it supported an unusually broad long tail of chains (Fantom, Moonriver, Dogechain, Kava, and dozens more) that larger bridges ignored, making it default infrastructure for many mid-tier ecosystems.

Outcome

Multichain became the dominant bridge by chain coverage, at one point supporting well over 80 networks and holding several billion dollars in TVL (peaking around $7+ billion by some counts). In January 2023, roughly $1.4 million disappeared from the Multichain-adjacent Qubit bridge exploit ecosystem, and the protocol had already suffered smaller anomalies. The terminal event began May 21, 2023, when Zhaojun was reportedly detained by Chinese authorities; the team says his devices, hardware wallets, and seed phrases were confiscated and MPC node access was revoked, cutting off the rest of the team from the infrastructure. Unusual outflows were detected in early July 2023 — about $126 million drained from Fantom, Dogechain, and Moonriver contracts — which the team attributed to Zhaojun's sister moving router-pool assets before she too was arrested on July 13. Multichain officially announced it was ceasing operations on July 14, 2023, the MULTI token collapsed, and dependent chains/protocols (Fantom-based projects especially) scrambled to deploy alternative bridges. No funds have been recovered and no charges or convictions have been publicly confirmed as of the last verification date; Zhaojun's and his sister's legal status in China remains unclear from public sources.

Why it worked

Prior to collapse, Multichain succeeded commercially by being the fastest bridge to support new and smaller chains, which made it the path of least resistance for emerging L1/L2 ecosystems needing liquidity from Ethereum and BNB Chain. Its MPC threshold-signature design was marketed as more secure and decentralized than simple multisig bridges, which won trust from integrators (aggregators, wallets, other DeFi protocols) that routed volume through it by default. Deep liquidity and broad chain coverage created a network-effect moat: more chains supported meant more protocols building on top, which reinforced Multichain's position as default infrastructure.

Where the design broke

The catastrophic failure was organizational and custodial, not purely technical: despite the MPC marketing, the team itself has stated that operational control of the keys/infrastructure was concentrated with Zhaojun rather than genuinely distributed, meaning the "decentralized" custody model had an undisclosed single point of failure at the human/organizational layer. When that one person became unreachable due to a geopolitical/legal event entirely outside the protocol's control, there was no fallback mechanism, no other party who could rotate keys or pause withdrawals safely, and no transparency into what was actually happening for weeks. The lack of verifiable, on-chain-enforced decentralization of custody — combined with opacity about who really controlled the MPC network — meant users bore full counterparty risk on a project they believed was trust-minimized.

Lessons

• Marketing a bridge as "MPC-secured" or "decentralized" is meaningless if operational key control is concentrated in one person or one legal jurisdiction; decentralization claims need to be independently verifiable on-chain, not asserted.
• Bridges that aggregate liquidity across many chains create outsized systemic risk for the entire ecosystem built on top of them (Fantom and other chains were badly damaged by dependence on a single bridge).
• Jurisdictional/key-person risk is a distinct threat category from smart contract bugs or economic exploits, and it can be just as fatal — protocols should have documented key-rotation and multi-party recovery procedures that don't depend on any single founder.
• Opacity about internal operations (who actually held keys, how funds were managed) let a fragile custody model masquerade as robust infrastructure for years before failing catastrophically.

Redesign (EDITORIAL)

EDITORIAL — hypothesis, not fact. A more resilient version of Multichain would have enforced genuine multi-party custody with keyholders in different legal jurisdictions and organizations (not just different servers under one founder's control), combined with an on-chain, time-locked emergency pause/migration mechanism that any threshold subset of keyholders (or even a DAO-elected emergency council) could trigger if a keyholder became unreachable for a defined period. Publishing regular, audited proof-of-reserves alongside a transparent, published list of who controls MPC shares would have let the market and integrators price in concentration risk before it materialized, and might have let other chains diversify bridge dependencies earlier rather than learning about the single point of failure only after $126 million had already moved.