WAX has paused processing on its multichain bridge while investigating a security incident reported on October 22.
Security researchers said the activity involved withdrawals on WAX that triggered asset releases on Solana and Ethereum without corresponding payment on the originating chain. WAX acknowledged the incident and described the pause as a precaution.
Key Takeaways
- WAX confirmed an incident affecting its multichain bridge and paused processing.
- Researchers reported five transactions involving stablecoins, wrapped Ether and wrapped Bitcoin.
- Published loss estimates differ, and a final reconciled total remains unconfirmed.
- Upbit and Bithumb issued caution notices concerning WAXP trading.
Researchers Flag Unpaid Withdrawals
Reporting on Blockaid’s findings identified transfers involving approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC.
These are token quantities, rather than a combined dollar valuation. Some early reports placed losses near $75,000, while other estimates were higher. They should not be presented as a confirmed final loss.
The reported failure concerns the relationship between a withdrawal request and the assets backing it. Cross-chain bridges coordinate activity across separate networks; an invalid instruction accepted on one side can therefore affect funds held elsewhere.
Negative Fee Input Under Review
An analysis published by XDRIP Central attributed the mechanism to findings from Blockaid and SlowMist.
According to that account, the withdrawal function accepted a negative fee value that offset the requested quantity, reducing the amount debited to zero while preserving the withdrawal instruction. The analysis reported matching inputs in public transaction records, while acknowledging that its explanation of the internal contract logic relied on the security firms’ findings.
This illustrates why smart contract validation matters at the point where a bridge creates its withdrawal record. A destination network may process an instruction correctly even when the originating application accepted an invalid request.
WAX had not supplied a full technical post-mortem in the cited reporting.
WAX Separates the Bridge Incident From Its Blockchain
In its public incident statement, WAX said it was investigating and had paused bridge processing. Reporting on the statement also said the team characterised the issue as confined to a bridge application contract, with WAXP and the underlying blockchain unaffected. That scope remains the project’s account.
Separately, CoinNess reported that Upbit and Bithumb urged caution in WAXP trading following signs of a possible bridge security issue. A caution notice should not be interpreted as a delisting announcement.
A blockchain explorer can help establish transaction amounts and timing. Confirming the complete incident scope also requires identifying affected contracts, reconciling assets across networks and reviewing the operator’s findings.
Conclusion
The bridge pause limits processing while WAX investigates, but it does not establish the final loss or confirm that repairs are complete. A technical post-mortem and reconciled asset accounting will be needed to explain the failure and assess the conditions for reopening.
