WAX bridge exploited, processing paused, hold new transfers

Do not submit bridge transfers until WAX confirms the bridge is back online.

Loss is about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC.

First reported Oct 22, 2026, 12:33 UTC

Source reports

🚨Blockaid detected an ongoing exploit on @WAX_io Multi-Chain Bridge on WAX, Solana, and Ethereum. An attacker withdrew mapped tokens without paying on WAX; Solana and Ethereum released them. ~52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, 0.11 WBTC across 5 txs. 🧵 — @blockaid_ (X), Oct 22, 2026, 12:33 UTC
又是一场噩梦！就在刚刚 #WAX 多链桥遭攻击。攻击者在 WAX 侧未付款，直接在 #Solana 和以太坊侧提走约 5.2 万 USDC、2.1 万 USDT 等映射代币。没付钱，直接提款，跨链消息验证成了摆设。#DeFi 的流动性，终究成了黑客的提款机？ — @SellerOfOptions (X), Oct 22, 2026, 12:55 UTC
🐦 WAX_io tweeted ℹ️ We are aware of an incident affecting the WAX Multi-Chain Bridge and are investigating. We paused bridge processing as a precaution. Please don't submit bridge transfers until we confirm the bridge is back online. The exploit affected only a small number of… — X (Twitter) Parser, Oct 22, 2026, 22:02 UTC

Excerpts are quoted from the linked sources, which own their text.

Follow @PopaRecon on X for new finds, and Web3AlphaFeed on Telegram.