WAX bridge exploit: negative fee made withdrawals free

Per Blockaid: ~52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC across 5 txs. WAX: 'only a small number of stablecoins'; no USD figure.

Root cause: Per Blockaid: 'eth.token::withdraw never requires max_fee ≥ 0 and debits quantity + max_fee. max_fee = −quantity charges 0; the bridge still logs a full withdrawal.'

Timeline, as sourced: Withdraw tx 22 Oct 2026 09:46:18 UTC (on-chain); Blockaid alert 12:33 UTC; bridge paused, WAX statement 22 Oct 22:02 UTC; resumed 23 Oct 15:50 UTC (per WAX).

On 22 October 2026 an attacker withdrew bridged tokens from the WAX Multi-Chain Bridge without paying for them on WAX. According to Blockaid (opens in a new tab), eth.token::withdraw did not require max_fee to be zero or more and debited quantity plus max_fee, so setting max_fee to minus the quantity charged nothing while the bridge still logged a full withdrawal; Solana and Ethereum then released the tokens. The WAX transaction (opens in a new tab) shows a withdrawal of 52,986.497732 WAXUSDC to Solana with a max_fee of -52,986.497732. Blockaid (opens in a new tab) counts about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC across five transactions. WAX said (opens in a new tab) the exploit affected only a small number of stablecoins, was confined to a bridge application contract, and that it had paused the bridge. It resumed processing (opens in a new tab) on 23 October at 15:50 UTC with a fix and added safeguards; WAX says the lost reserves will be replenished.