Security firm SlowMist has identified a private key leak as the likely cause of the recent attack on the cross-chain bridge project 402Bridge. Analyst Yu Chui noted that insider involvement cannot be ruled out. The attacker's address acquired approximately 4.2 ETH, which was transferred to the Arbitrum network, with no further movement detected. The 402bridge.fun domain was operational for only two days before the attack, marking the first known security breach involving 402 protocol-related services.