WAX bridge drained through a negative-fee bug, reopens a day later

An attacker drained assets including roughly $75,000 in stablecoins, as well as wrapped ether and bitcoin, from the WAX Multi-Chain Bridge on Oct. 22 by exploiting a single unchecked fee field. WAX, a blockchain built for gaming and NFTs, paused the bridge — the link that moves tokens between WAX and other chains — on Oct. 23 and reopened it a day later with a fix. South Korean exchange Upbit issued a trading caution notice on WAXP late on Oct. 22.

A negative number in the fee field

WAX on-chain records show the attacker created an account named fasdfas.al at 6:06 p.m. KST on Oct. 22. Forty minutes later, at 6:46 p.m., the account asked the bridge token contract (eth.token) to send 52,986.5 WAX-based USDC to Solana. In the max_fee field it entered a negative value equal to the withdrawal amount: −52,986.5.

According to security firm Blockaid, the contract debits the withdrawal amount plus the fee from the user's balance but never checked that the fee was zero or higher. The negative fee cancelled out the withdrawal, so nothing was actually deducted, yet the bridge logged a full withdrawal. The Solana and Ethereum sides trusted that record and released real tokens. Blockaid said the releases on Solana and Ethereum themselves were processed normally and that the vulnerability was in the WAX-side contract.

1. Oct. 22, 18:06Attacker account fasdfas.al created
2. Oct. 22, 18:46Withdrawal of 52,986.5 USDC requested with a matching negative fee
3. Oct. 22, 18:47Withdrawal requests for USDT, DAI, WETH and WBTC submitted the same way
4. Oct. 22, 19:00USDC released on Solana; Ethereum followed five minutes later
5. Oct. 22, 21:33Blockaid warns on X of an ongoing exploit
6. Oct. 22, 23:25Upbit posts a caution notice on WAXP
7. Oct. 23, 07:02WAX announces it has paused bridge processing
8. Oct. 24, 00:50WAX bridge resumes processing

Blockaid counted about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC taken across five transactions (times above in KST). The dollar-pegged stablecoins alone come to about $75,000, and the stolen assets also included WETH and WBTC, which are not stablecoins.

WAX says the chain and WAXP were untouched

At 7:02 a.m. KST on Oct. 23, WAX said on its official X account, "We are aware of an incident affecting the WAX Multi-Chain Bridge and are investigating," adding that it had paused bridge processing as a precaution. "The exploit affected only a small number of stablecoins. WAXP tokens were unaffected," it said. "The WAX blockchain itself was not affected and continues to operate normally. The issue is confined to a bridge application contract." It asked users not to submit bridge transfers until it confirmed the bridge was back online.

The pause lasted about a day. Early on Oct. 24 KST, WAX said, "The bridge resumed processing on October 23 at 15:50 UTC, with the fix and additional safeguards in place. The lost reserves will be replenished to guarantee all bridge withdrawals." That is 12:50 a.m. KST on Oct. 24. WAX did not say when or with what funds the reserves would be replenished, and it has not announced any recovery of funds from the attacker's wallets.

Upbit issues caution notice; no deposit or withdrawal suspension announced

In a notice at 11:25 p.m. KST on Oct. 22, Upbit said it had "confirmed circumstances suggesting a security problem occurred on the WAX (WAXP) multi-chain bridge" and warned users that price volatility could rise. It linked to Blockaid's X post and the exploit transaction as references. The caution notice is an advisory and is separate from designating a token as an investment caution asset. As of the afternoon of Oct. 25, Upbit had posted no notice suspending WAXP deposits or withdrawals. WAXP trades on Upbit's Korean won and BTC markets and on Bithumb.

The price swung sharply on the day of the attack. On Binance daily candles (UTC), WAXP opened Oct. 22 at $0.00484, fell more than 9% intraday to $0.00439 and closed at $0.00457. It then held around $0.0045 to $0.0046. At 3:30 p.m. KST on Oct. 25, it traded at 6.07 won on Upbit. Earlier that day it briefly hit 7.26 won on Upbit, and 24-hour trading value swelled to about 3.3 billion won, well above the 200 million to 900 million won a day seen from Oct. 22 to 24. At the same time, the Bithumb price was 6.076 won, and Upbit traded about 1.1% above the Binance price converted to won (about 6.00 won), a gap known as the kimchi premium (the difference between prices on Korean exchanges and global markets).