Hack history / 2026 / Hack or exploit
WAX Multi-Chain Bridge
Hack or exploit on Oct 22, 2026 · Missing Input Validation
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$90K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,762
among thefts by dollars lost
What happened
WAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereum
Details
- Date
- Oct 22, 2026
- Kind
- Hack or exploit
- Method
- Missing Input Validation
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Solana, Ethereum, WAX
Reported by
Related incidents
Pirate Chain 2026 · Hack or exploit · $10.7M
Ledger (Supply Chain) 2026 · Hack or exploit · $93M
Projects on the defunct Neutron chain lose $1.8 million to governance attack, Cosmos Hub halts chain 2026 · Hack or exploit · $9.5M
Dream Health Chain 2026 · Hack or exploit · $72K
MANTRA Chain 2026 · Hack or exploit · $3.6M
Ledger (Supply Chain) 2026 · Hack or exploit · $93M
Projects on the defunct Neutron chain lose $1.8 million to governance attack, Cosmos Hub halts chain 2026 · Hack or exploit · $9.5M
Dream Health Chain 2026 · Hack or exploit · $72K
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "WAX Multi-Chain Bridge hack, Oct 22, 2026: $90K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht14bd7bdcce/ (data as of 2026-10-31).