Threat Pulse 62High
WAX multi-chain bridge negative fee drains $90.5K
Severity 3Status unknownconfirmedCrypto

Input validation failure allowed a negative max_fee to trigger withdrawals without payment releasing about $90.5K across chains.

What to do: Patch the fee validation logic and monitor recovered funds.

· 14 days ago · WAX bridge users · bitquery.io
Sourcesbitquery.io
On X
@0xPandaSecurityverifiedOct 24, 05:01 UTC

WAX Bridge Exploit: A Negative Fee Drained ~$90K On 22 October 2026, between 09:46 and 09:48 UTC, an attacker sent five withdrawal requests to the WAX Multi-Chain Bridge and walked away with about 52,986 USDC, 21,558

Open on X
Why this score

Re-scored from the verified-lane dataset (Grok severity capped by the rubric)

Back to the board

Updated Nov 5, 01:44 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.