-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0264
============================================================

Advisory-ID:  0xCERT-2026-0264
Severity:     Low
Published:    2026-10-22T12:33:58.000Z
Updated:      2026-10-23T00:42:18.762Z
Chains:       Ethereum, Solana, Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0264

Title: WAX multi-chain bridge exploited to release about $75k-$90k in mapped tokens on Solana and Ethereum

Summary
- -------
On 2026-10-22 Blockaid flagged an ongoing attack on the WAX multi-chain bridge (WAX, Solana, Ethereum): mapped tokens were withdrawn on WAX without the matching assets being paid in, and the Solana and Ethereum bridge contracts still released the funds. Reported losses are about $75k-$90.5k. Bridge users should hold off on transfers until WAX confirms a fix.

Details
- -------
Summary
On 2026-10-22 the security firm Blockaid reported that the WAX multi-chain bridge, which connects WAX, Solana and Ethereum, was under continuous attack. Per Blockaid, the attacker withdrew mapped tokens on the WAX side without paying in the corresponding assets, and the bridge contracts on Solana and Ethereum still released the matching tokens. DeFiLlama lists the incident as missing input validation.

Affected
- - WAX multi-chain bridge (WAX <-> Solana / Ethereum)
- - Fixed in: no fix or official statement from WAX had been published by the sources reviewed at the time of publication

Impact
Blockaid counted five related transactions moving about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC (reported as roughly $75k). DeFiLlama records the loss as $90.5k. The two figures disagree, and at the time of the alert the full scope, and whether losses were still growing, had not been confirmed. Exploitation in the wild is confirmed by Blockaid's monitoring. Some secondary reports attribute the flaw to a fee-handling bug in the bridge's withdraw function; WAX has not confirmed this, and 0xCERT has not verified it.

Recommended actions
- - Avoid bridging assets through the WAX multi-chain bridge until WAX publishes a status update or fix.
- - Exchanges and bridges: watch for related flows once on-chain indicators are published by a primary source.

Source & attribution
This 0xCERT advisory summarises an alert by Blockaid (https://x.com/blockaid_/status/2113247490950696982), as relayed by PANews (https://panews.io/articles/01a1639c-8105-77ef-ac08-6abb865d1299) and TechFlow (https://www.techflowpost.com/en-US/newsletter/140995), and the DeFiLlama hacks database entry (https://defillama.com/hacks). No indicators are listed because the primary alert's addresses and transaction hashes could not be retrieved verbatim. Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/blockaid_/status/2113247490950696982
- - https://panews.io/articles/01a1639c-8105-77ef-ac08-6abb865d1299
- - https://www.techflowpost.com/en-US/newsletter/140995
- - https://defillama.com/hacks

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrcPrMJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmemorjQp24rcuvMppj20hMj1a+MIZwXLdn179L6
d8H6fRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAA8ygD/VyKgqSbJQhjsq5m8
4feggNN4zrhrtCJMkK7hcBqPbAwBAI+HoCjmsOzoa9kA4qkGQ2csxO7naytm
/YxFhC+JpMMC
=Fjmj
-----END PGP SIGNATURE-----