WAX Cross-Chain Bridge Under Attack, Millions in Assets at Risk
Cybersecurity firm Blockaid has issued a warning that the WAX multi-chain bridge is currently under attack. The attacker has reportedly siphoned approximately $52,986 in USDC, $21,558 in USDT, and other assets from the Solana and Ethereum sides of the bridge through five transactions. Blockaid stated that the contract code has not yet been altered, and WAX officials have not responded as of press time.
Blockchain cybersecurity firm Blockaid issued an alert on X (formerly Twitter) at 8:33 PM Taipei time on October 22nd, indicating that the multi-chain bridge for NFT and gaming public chain WAX is under attack. The attacker was able to withdraw assets from the Solana and Ethereum sides without making actual token payments on the WAX side.
According to Blockaid’s statistics, the five transactions resulted in the outflow of approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC. The stablecoin portion alone totals around $75,000. While the overall scale of the incident is not massive, it is ongoing.
Blockaid, a cybersecurity firm that provides real-time fraud and attack detection for companies like Coinbase and MetaMask, detected this attack and issued the public warning.
The operational logic of a cross-chain bridge involves locking or deducting assets on the source chain and then releasing corresponding “wrapped tokens” (cross-chain equivalent assets) on the target chain. Blockaid pointed out that the issue lies in the withdrawal checks of the WAX-side token contract, which allowed the attacker to proceed with withdrawals at virtually no cost, while the cross-chain bridge still recorded them as complete.
In a follow-up thread, Blockaid emphasized that the lending processes on the Solana and Ethereum sides were executed “honestly.” In other words, the two chains simply released funds based on the erroneous records from the WAX side, meaning the vulnerability is not on Solana or Ethereum.
According to the timeline released by Blockaid, the attacker first completed withdrawal operations on the WAX side. Approximately 15 to 20 minutes later, Solana released the corresponding USDC, followed by Ethereum releasing the remaining assets. The entire process was completed within an hour.
More concerningly, Blockaid stated in their explanation of the attack flow that the relevant code has not yet been modified, and the vulnerability “remains exploitable.” This implies that the remaining liquidity on the other side of the cross-chain bridge is still at risk until a fix is implemented.
As of press time (9:00 PM Taipei time on October 22nd), a review of WAX’s official X account by this publication revealed no accident announcements, bridge suspensions, or confirmations of losses.
Blockaid also mentioned that after the attack, there was a discrepancy of approximately $1,522 in the accounts, representing the difference between the bridge’s inventory and the WAX-side ledger. The actual scope of the impact remains to be confirmed by the official team.
Furthermore, this publication has not yet found independent reports from other cybersecurity firms such as PeckShield, CertiK, or SlowMist. The reported loss figures currently come solely from Blockaid and have not been confirmed by WAX officials.
Cross-chain bridges require synchronizing ledgers across multiple chains. Any verification error on one end can lead to the other end releasing funds out of thin air. In September, the Symbiosis cross-chain bridge was exploited for approximately $330,000, and the Taiko cross-chain bridge also reported losses in June.
According to data compiled by this publication from PeckShield and CertiK, September saw crypto hacks totaling $766 million, marking the worst month of the year. In comparison, while the WAX incident involves a smaller sum, the “unpatched vulnerability” status warrants user vigilance.
It is important to note that the Railway hack and the critical PHP vulnerability earlier this week are Web2 infrastructure incidents, and there is currently no evidence linking them to the WAX cross-chain bridge attack.
For users holding WAX cross-chain assets, it is advisable to temporarily halt asset transfers through the bridge until the official team provides a statement. How WAX will patch the vulnerability, whether losses will be compensated, and if the attack will continue to expand remain to be seen pending an official response.
Leave a Reply