WAX Multichain Bridge Hit by Asset Release Exploit
An ongoing security issue allows tokens to be drained across Solana and Ethereum without verifying payments on WAX.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you trust the security of cross-chain bridges for managing your digital assets?
Security firm Blockaid has identified an active exploit targeting the WAX multichain bridge. The attacker triggered the release of various digital assets on Solana and Ethereum without completing the required payments on the WAX network.
Why it matters
The incident highlights critical vulnerabilities in cross-chain bridge security, where the synchronization of asset locking and release remains a high-value target for exploitation.
The exploit involved five distinct transactions that successfully released 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC across the Solana and Ethereum networks. These assets were moved without the necessary payment verification on the WAX side.
The players
Blockaid
A blockchain security company that provides tools to detect and block malicious transactions and phishing attempts in the Web3 ecosystem.
WAX
A blockchain network optimized for decentralized applications, gaming, and non-fungible tokens.
Solana
A high-performance blockchain network designed for fast transaction processing and decentralized applications.
Ethereum
A leading decentralized blockchain platform that enables smart contracts and hosts the majority of the world's decentralized finance protocols.
The details
The attack bypassed the validation mechanisms intended to ensure assets are locked or paid on the source chain before being released on the destination chain. By exploiting this logic flaw in the multichain bridge, the attacker was able to trigger asset releases on Solana and Ethereum while the WAX network failed to register the corresponding payments. This type of failure typically occurs when the bridge's smart contract—a self-executing program that runs automatically when predetermined conditions are met—does not properly verify the state of a transaction across disparate blockchain ecosystems.
Timeline
October 22, 2026: Blockaid flagged the active attack on the WAX bridge.
The Tech Race
This incident mirrors the vulnerability patterns observed in previous high-profile bridge exploits like the 2022 Ronin bridge hack. It underscores the ongoing industry challenge of securing cross-chain bridges against sophisticated transaction logic attacks.
Users of the WAX bridge should monitor official project communications regarding the status of the affected cross-chain liquidity pools. As this remains an active security event, participants should avoid interacting with the bridge until developers release a patch or confirm the issue is resolved.
The takeaway
This attack serves as a stark reminder that multichain bridges are complex software systems with unique, often untested, failure points. Security researchers and users should watch for future technical audits of the WAX bridge protocol to see how the vulnerability is remediated.
Further reading
For broader trends in infrastructure protection, see the latest updates in Cybersecurity.
Live Poll
Do you trust the security of cross-chain bridges for managing your digital assets?
