-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0172
============================================================

Advisory-ID:  0xCERT-2026-0172
Severity:     High
Published:    2026-09-23T00:00:00.000Z
Updated:      2026-10-08T22:46:36.081Z
Chains:       Other / Multi-chain, BNB Chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0172

Title: Meter Passport Unbacked Mint Exploit

Summary
- -------
An attacker abused a block-validation flaw in Meter to mint unbacked wrapped MTRG through the Meter Passport bridge, dumping about $2.3 million of it on PancakeSwap and crashing both MTR and MTRG.

Details
- -------
Summary
An attacker abused a block-validation flaw in Meter to mint unbacked wrapped MTRG through the Meter Passport bridge, dumping about $2.3 million of it on PancakeSwap and crashing both MTR and MTRG.

Incident
- - Victim: Meter
- - Date (UTC): 2026-09-23
- - Estimated loss: $2.3M
- - Chain(s): Meter, BNB Chain
- - Attack type: bridge exploit
- - Funds status: stolen

Recommended actions
- - Revoke token approvals granted to Meter contracts until the project confirms they are safe
- - Integrators: pause or delist affected assets and monitor for attacker fund movements
- - Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/meter-2026. Primary sources: https://protos.com/defi-hack-attack-three-exploits-snatch-11m-in-a-single-day/ ; https://www.cryptotimes.io/2026/09/24/meter-passport-exploit-reportedly-mints-2-3-million-in-unbacked-mtrg/ ; https://phemex.com/news/article/meter-protocol-under-active-exploit-on-bnb-chain-as-attacker-mints-23m-in-unbacked-tokens-97771.

References
- ----------
- - https://www.blockchainbreaches.com/en/breaches/meter-2026
- - https://protos.com/defi-hack-attack-three-exploits-snatch-11m-in-a-single-day/
- - https://www.cryptotimes.io/2026/09/24/meter-passport-exploit-reportedly-mints-2-3-million-in-unbacked-mtrg/
- - https://phemex.com/news/article/meter-protocol-under-active-exploit-on-bnb-chain-as-attacker-mints-23m-in-unbacked-tokens-97771

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrISDEJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcEb8wK+qxynq6x0Jx75vAWbqvL27/qziDXz247
KpvYBhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACjkgEArwht9Nb4W0eP6lhe
BZLwARG/6d3c59x5eBYYUEv8TkQBAMK/WztuJxHqEE/J8gjPKdFt6TtSQ1Ot
v5/8VAeZTJID
=iOY0
-----END PGP SIGNATURE-----