Blockaid flagged an ongoing exploit of the WAX Multi-Chain Bridge today, Oct 22, 2026, across WAX, Solana and Ethereum (post).

Blockaid flagged an ongoing exploit of the WAX Multi-Chain Bridge today, Oct 22, 2026, across WAX, Solana and Ethereum (post).

The attacker withdrew mapped tokens without paying on the WAX side, while Solana and Ethereum released them. Blockaid puts the loss at about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC across 5 transactions.

Its root-cause note says eth.token::withdraw debited quantity plus max_fee without requiring max_fee at least zero, so a negative max_fee charged zero but still logged a full withdrawal (post). Its timeline says 09:06 domain created, 09:46-09:47 WAX withdrawals, 10:00 Solana payout of 52,986.50 USDC, 10:05 Ethereum releases.

WAX confirmed it is aware of an incident affecting the bridge and investigating, and said it paused bridge processing as a precaution (post). It asked users not to submit bridge transfers until it confirms the bridge is back online.

WAX added the exploit affected only a small number of stablecoins, WAXP tokens were unaffected, the WAX blockchain was not affected and continues to operate normally, and the issue is confined to a bridge application contract.

WAXP trades around $0.00454 on Binance spot, down about 6.6% in 24h, as exchanges quote it.