Meter Passport Unbacked Mint Exploit

On September 23, 2026, Meter — a cross-chain infrastructure project whose Meter Passport bridges assets between its own chain and networks like BNB Chain — was exploited when an attacker minted unbacked wrapped tokens and dumped them for approximately $2.3 million.

What happened

Beginning around 21:14 UTC, the attacker exploited what Meter later described as a block-validation flaw to mint large amounts of wrapped MTRG (and MTR) that had no real collateral behind them. Using Meter Passport, the project's cross-chain bridge, the freshly minted wrapped MTRG landed on BNB Chain, where the attacker sold it on the PancakeSwap decentralized exchange across a small number of transactions. Security monitor Blockaid flagged the attack while it was still ongoing, estimating roughly $2.3 million of unbacked wrapped MTRG created and partly sold. The dumping crashed the market: MTRG fell by more than 80% and MTR — a token designed to track the cost of producing 10 kWh of electricity — collapsed by a similar margin.

Aftermath

Meter paused both its blockchain and the Passport bridge and urged users to stop trading the affected tokens. The team warned that "transactions after block 100731417 may not be honored," signalling that a chain rollback was under consideration to unwind the fraudulent mints. As of late September 2026 no funds had been recovered and no full post-mortem published, so the status here is stolen. The incident was one of three DeFi exploits that struck within roughly 24 hours, alongside the Payy Network bridge exploit and the Duelbits hot-wallet hack.

Why it matters

A bridge is only as trustworthy as its proof that every wrapped token is backed by a real deposit. When a validation flaw lets an attacker conjure wrapped assets from nothing, the bridge becomes an unlimited printing press until someone notices. The pattern echoes the same-month Nomic nBTC double-spend and Symbiosis fake-syBTC mint: mint authority must be gated behind independently verified collateral, never a message the attacker controls.