-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0265
============================================================

Advisory-ID:  0xCERT-2026-0265
Severity:     Low
Published:    2026-10-22T00:00:00.000Z
Updated:      2026-10-23T07:23:32.447Z
Chains:       Other / Multi-chain, Solana, Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0265

Title: WAX Bridge Zero-Fee Withdrawal Exploit

Summary
- -------
A missing fee check in WAX's bridge withdraw function let an attacker pull mapped tokens for free, draining about $90,500 across WAX, Solana and Ethereum.

Details
- -------
Summary
A missing fee check in WAX's bridge withdraw function let an attacker pull mapped tokens for free, draining about $90,500 across WAX, Solana and Ethereum.

Incident
- - Victim: WAX
- - Date (UTC): 2026-10-22
- - Estimated loss: $91k
- - Chain(s): WAX, Solana, Ethereum
- - Attack type: bridge exploit
- - Funds status: stolen

Recommended actions
- - Revoke token approvals granted to WAX contracts until the project confirms they are safe
- - Integrators: pause or delist affected assets and monitor for attacker fund movements
- - Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/wax-2026. Primary sources: https://www.cryptotimes.io/2026/10/22/wax-multi-chain-bridge-exploited-for-roughly-75000/ ; https://panews.io/articles/01a1639c-8105-77ef-ac08-6abb865d1299 ; https://coinfomania.com/wax-suffers-90-5k-loss-due-to-technical-oversight/ ; https://phemex.com/news/article/wax-multichain-bridge-exploited-attacker-extracts-75000-in-crosschain-assets-100687.

References
- ----------
- - https://www.blockchainbreaches.com/en/breaches/wax-2026
- - https://www.cryptotimes.io/2026/10/22/wax-multi-chain-bridge-exploited-for-roughly-75000/
- - https://panews.io/articles/01a1639c-8105-77ef-ac08-6abb865d1299
- - https://coinfomania.com/wax-suffers-90-5k-loss-due-to-technical-oversight/
- - https://phemex.com/news/article/wax-multichain-bridge-exploited-attacker-extracts-75000-in-crosschain-assets-100687
- - https://www.tokenpost.com/news/technology/38523

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroIisJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfhumCrw+3oKpUV8Y3MslqG8p8Dv6yU6qp1odMP
aH5BFBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAD8IQD/Yz5WovHjrwo2Ml9J
/d69A4b+RAPdu/PdigeMHeUL94sA+QFFTcULfW0BGZ2R35C2ZaePCq609iPg
vdYL/rLNcTEH
=Ag3M
-----END PGP SIGNATURE-----