WAX multi-chain bridge exploited to release about $75k-$90k in mapped tokens on Solana and Ethereum

Summary

On 2026-10-22 the security firm Blockaid reported that the WAX multi-chain bridge, which connects WAX, Solana and Ethereum, was under continuous attack. Per Blockaid, the attacker withdrew mapped tokens on the WAX side without paying in the corresponding assets, and the bridge contracts on Solana and Ethereum still released the matching tokens. DeFiLlama lists the incident as missing input validation.

Affected

• WAX multi-chain bridge (WAX <-> Solana / Ethereum)
• Fixed in: no fix or official statement from WAX had been published by the sources reviewed at the time of publication

Impact

Blockaid counted five related transactions moving about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC (reported as roughly $75k). DeFiLlama records the loss as $90.5k. The two figures disagree, and at the time of the alert the full scope, and whether losses were still growing, had not been confirmed. Exploitation in the wild is confirmed by Blockaid's monitoring. Some secondary reports attribute the flaw to a fee-handling bug in the bridge's withdraw function; WAX has not confirmed this, and 0xCERT has not verified it.

Recommended actions

• Avoid bridging assets through the WAX multi-chain bridge until WAX publishes a status update or fix.
• Exchanges and bridges: watch for related flows once on-chain indicators are published by a primary source.

Source & attribution

This 0xCERT advisory summarises an alert by Blockaid (https://x.com/blockaid_/status/2113247490950696982), as relayed by PANews (https://panews.io/articles/01a1639c-8105-77ef-ac08-6abb865d1299) and TechFlow (https://www.techflowpost.com/en-US/newsletter/140995), and the DeFiLlama hacks database entry (https://defillama.com/hacks). No indicators are listed because the primary alert's addresses and transaction hashes could not be retrieved verbatim. Details may change; refer to the original sources for the authoritative record.