WAX Bridge Zero-Fee Withdrawal Exploit

On October 22, 2026, the WAX multi-chain bridge was exploited for approximately $90,500. A missing fee check in the bridge's eth.token::withdraw function let an attacker withdraw mapped tokens on the WAX side without surrendering the backing the accounting expected, while the bridge's contracts on Solana and Ethereum still released the corresponding assets.

What happened

WAX (Worldwide Asset eXchange) operates a multi-chain bridge that issues "mapped" representations of assets custodied on other networks. Monitoring firm Blockaid flagged an active exploit on October 22, 2026: the attacker created a fresh WAX account and, roughly an hour later, began calling the bridge's withdraw path. Because the eth.token::withdraw function did not enforce the withdrawal fee, the operation went through for free — the attacker pulled mapped tokens on the WAX side without paying the assets the bridge's accounting assumed, while the bridge contracts on Solana and Ethereum still released the matching tokens.

Across five transactions, the attacker extracted roughly 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC. Early tallies put the haul near $75,000; updated accounting that priced in the WETH and WBTC legs raised the estimate to about $90,500.

Aftermath

Blockaid and SlowMist publicized the incident while it was still developing. At the time of writing, WAX had not published a formal post-mortem or disclosed recovery efforts, and no attacker identity, wallet label, or on-chain address had been confirmed in public reporting. Investigators cautioned that the full scope — and whether losses were still growing — remained to be verified. The dollar figure is small by catalogue standards, but the mechanism is the dangerous part: a single unguarded fee path desynchronized the bridge's two-sided bookkeeping.

Why it matters

A bridge is only as safe as the invariant that assets released on one chain are fully backed by assets locked or debited on the other. The WAX exploit is a textbook accounting desync: the release side kept paying out even though the source side was not charged as the design assumed. It rhymes with Alephium's TokenBridge, where forged approvals unlocked custody reserves, and with the repeat Verus-Ethereum bridge drains that abused an unchecked import/verification path — and, at vastly larger scale, with Ronin, whose bridge released funds on a vote-weight invariant that had quietly been left at zero. In each case the loss came not from broken cryptography but from a missing check in the code meant to keep both halves of the ledger honest. Small bridges with real cross-chain custody remain a recurring soft target precisely because these fee- and validation-path bugs are easy to overlook and immediately monetizable.