WAX blockchain bridge exploit paused processing, then resumed

The WAX bridge exploit on WAX blockchain produced five withdrawal requests on October 22, 2026, and the destination ledgers show the same quantities leaving the bridge accounts on Ethereum and Solana. The project account's incident post that evening described an exploit affecting a small number of stablecoins. The withdrawal records also name mapped wrapped ether and mapped wrapped bitcoin, a wider set than that stablecoin wording. The reserve, separate from block production on WAX blockchain, is the ledger that paid.

What the withdrawal records show

The indexed history for the signing account fasdfas.al contains 19 actions, all dated October 22, and the earliest is a resource purchase at 09:06 UTC. The withdrawal actions sit on the bridge accounting contract and run from 09:46:18 UTC to 09:47:44 UTC. The first record asks the Solana leg to release 52,986.497732 USD Coin (USDC) to the Solana address named in the action. The next four, all aimed at one Ethereum address, request 21,558.252354 Tether (USDT), 840.27503390 Dai (DAI), 2.54669928 wrapped Ether (WETH) and 0.10993227 wrapped Bitcoin (WBTC). Each bridge log names the destination mint or contract and the same unit count.

On Solana, a finalized transaction at 10:00:55 UTC moved 52,986.497732 USDC from bridge account 8cqv3kRg1ivwPNrGGrvJANXb6RPik6XEhnBzs18tPcKC to the address named in the withdrawal, cutting that bridge balance from 54,508.429652 USDC to 1,521.93192 USDC. At 10:12:38 UTC the receiving address sent 52,986 USDC onward and left 0.497732 USDC. On Ethereum, token transfers for the receiving address show bridge contract 0x24b22B031Ae1B5a6b09F9a0FD33613a40e0d70e6 sending 21,558.252354 USDT at 10:05:35 UTC, 840.27503390 DAI at 10:05:47 UTC, 2.54669928 WETH at 10:05:59 UTC and 0.10993227 WBTC at 10:06:11 UTC. That address forwarded each of those balances out over the following minutes.

Related:Papertrade keeps PAPER token non-transferable amid criticism

Blockaid's alert, posted at 12:33 UTC the same day, described mapped tokens being withdrawn without a matching payment while Solana and Ethereum still released them, across five transactions and the same asset list. SlowMist's alert named the same accounting contract, the same Solana bridge account and the same Ethereum bridge contract. GoPlus Security's note on October 23 said the Solana and Ethereum sides still paid the withdrawals out.

What the project told users

The incident post, timestamped 22:02 UTC on October 22, said: "We are aware of an incident affecting the WAX Multi-Chain Bridge and are investigating. We paused bridge processing as a precaution." It asked users to hold fresh bridge transfers until the service was confirmed back online, said the chain's native token was unaffected, and said WAX blockchain itself continued to operate because the fault sat in a bridge application contract.

A later post on the same account said the bridge resumed processing on October 23 at 15:50 UTC, "with the fix and additional safeguards in place," and that "the lost reserves will be replenished to guarantee all bridge withdrawals." The incident feed on the project's public status page returned an empty incident list when opened on October 25, stamped 08:15 UTC that morning. The replenishment line is a promise about reserves, and a token-by-token balance sheet is absent from both posts.

Desks that inventory a mapped asset against a destination reserve, rather than against block production on WAX blockchain, are the ones this WAX bridge exploit touches. Circle's terms that can delay a USDC redemption show a stablecoin unit and a same-day cash claim booked in different places. Standard Chartered's Zodia custody signing and CDK Besu's arrival on Ethereum mainnet turn on the same question of where the settled asset lives. Five mapped balances left these bridge accounts, and the refill pledge is what a reserve checklist has to carry.

The next observable test is whether the Ethereum bridge contract and the Solana bridge account are refilled to cover the quantities that left on October 22, because a restart clock on its own leaves the reserve question open. The project has said the fix and further safeguards are in place and that lost reserves will be replenished so withdrawals clear. Until a published reserve figure matches those outgoing transfers, a mapped token on WAX blockchain remains a claim on that refill.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.