WAX Bridge Attack Releases Mapped Tokens Without WAX-Side Payment

Blockaid flagged an active attack on WAX’s multichain bridge on Oct. 22, describing mapped tokens released on Solana and Ethereum without corresponding payment on WAX.

The five transactions involved about 52,986 USD Coin (USDC), 21,558 Tether (USDT), 840 Dai (DAI), 2.55 Wrapped Ether (WETH) and 0.11 Wrapped Bitcoin (WBTC). The amounts were spread across five transactions rather than a single transfer. These figures are token quantities, not a combined dollar valuation of the incident.

The alert named three networks: WAX, Solana and Ethereum. Its described flow had a clear split: WAX received no payment, while Solana and Ethereum released the mapped assets. That cross-network mismatch is the central security issue in the incident.

Blockaid characterized the activity as ongoing when it issued the alert. The reported transfers covered five assets and two destination networks, with no WAX-side payment accompanying the releases.