A Negative Fee, a Zero Debit: The WAX Bridge Exploit

On 22 October 2026, the multi-chain bridge that connects WAX with Solana and Ethereum was exploited. Security firms Blockaid and SlowMist both published the cause within hours, and WAX has since confirmed the incident. The sums involved are modest. The mechanism is the useful part, because it shows how one missing input check on one chain can make every other chain pay out.

What happened#

According to Blockaid, an attacker withdrew mapped tokens on WAX without paying for them, and the Solana and Ethereum sides of the bridge then released real assets. Blockaid listed about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC across five transactions.

We checked this against public chain data. The WAX history shows five eth.token::withdraw actions from one newly active account, the first at 09:46 UTC on 22 October and the other four within the next two minutes. The quantities match Blockaid's list. On Solana, the bridge's address sent 52,986.497732 USDC to the attacker's address at 10:00 UTC, which matches the first WAX withdrawal to the unit. We did not check the Ethereum side ourselves.

The mechanism#

Both firms name the same function. SlowMist says eth.token::withdraw "failed to enforce max_fee ≥ 0 before debiting quantity + max_fee". Setting max_fee to the negative of the quantity therefore reduced the debit to zero, "while preserving the full withdrawal amount". Blockaid adds that the fee check is skipped when the fee is zero, and that the bridge still logged a full withdrawal.

The chain data is consistent with this. In each of the five withdrawals, max_fee is exactly the negative of quantity. The account opened empty balance rows for the tokens in the same transactions, and all five balances read zero today. We cannot read the contract's code, so the exact internal logic rests on the two firms' analyses. The visible inputs and outputs match what they describe.

Why the other chains were not the problem#

Blockaid states that the Solana and Ethereum releases were "honest": they paid out against a WAX-side withdrawal record that was itself false. A destination chain can only check what the origin chain shows it. If the origin emits a valid-looking event for a withdrawal that was never paid for, everything downstream is trusting a false record. This differs from the Cysic bridge incident we covered earlier, where the problem was an unauthorised mint message. Here, an ordinary withdrawal request passed validation with a value nobody expected.

What is reported, and what is not#

• Mechanism: reported by Blockaid and SlowMist, and consistent with the on-chain records we read. WAX has not published a technical account.
• Loss: the figures differ. SlowMist puts it at about $90,500. The Crypto Times reports roughly $75,000 on the basis of Blockaid's amounts. The Blockaid posts we read list token quantities and no dollar total. We have not calculated one.
• Affected assets: WAX says the exploit affected "only a small number of stablecoins". The withdrawals on chain also include wrapped ETH and wrapped BTC.
• Pause: WAX said at 22:02 UTC that it paused bridge processing "as a precaution" and asked users not to submit bridge transfers. The statement does not say when the pause took effect. Blockaid was still describing the code as unchanged and the exploit as live at 12:38 UTC.
• Scope: WAX says WAXP and the WAX blockchain were unaffected and that the issue is confined to a bridge application contract. We have not verified this.
• Still open: we found no post-mortem, no confirmation of the final loss and no statement on when the bridge returns.

What teams can take from it#

Three points follow from the published facts. First, negative numbers are an input class of their own, and an explicit lower bound removes it. Second, logic that is skipped when a value is zero deserves the same review as the logic that runs. Third, the record that triggers a payout on one chain must be validated where it is created, because the chains that act on it cannot tell the difference.

We will update this note if WAX publishes a post-mortem with verified figures.

Sources#

• WAX, statement on the incident, 22 October 2026: https://x.com/WAX_io/status/2113390476225397077
• Blockaid, alert and thread, 22 October 2026: https://x.com/blockaid_/status/2113247490950696982
• SlowMist, TI alert, 22 October 2026: https://x.com/SlowMist_Team/status/2113290086808990182
• WAX transaction 406b76e8…8fb0c9, the first withdrawal, public chain data: https://waxblock.io/transaction/406b76e85ac057ac7322d4bf7ddbea6ac4a2b23539deaa00ea635d17518fb0c9
• The Crypto Times, "WAX Multi-Chain Bridge Exploited for Roughly $75,000 as Attacker Withdraws Tokens", 22 October 2026: https://www.cryptotimes.io/2026/10/22/wax-multi-chain-bridge-exploited-for-roughly-75000/
• SlowMist Hacked database, WAX Multi-Chain Bridge entry: https://hacked.slowmist.io/?id=8e17eb70-9d20-46d6-8b3a-2e3c9b2f0c45