Butter Bridge
Hack or exploit on May 20, 2026 · Smart Contract Vulnerability
What happened
The Butter Bridge V3.1 (part of MAP Protocol and Butter Network) was exploited. An attacker used a vulnerability in the OmniServiceProxy contract’s retry message verification logic, specifically an abi.encodePacked hash collision with dynamic-bytes fields. This allowed forging a cross-chain retry message that bypassed authentication, resulting in the minting of approximately 1 quadrillion (10^15) MAPO tokens (about 4.8 million times the legitimate ~208 million circulating supply). The attacker dumped ~1 billion fake MAPO into the Uniswap V4 ETH/MAPO pool, extracting roughly $180,000 in liquidity (≈52.21 ETH). The teams immediately paused the bridge and related swaps. User funds in pending swaps are safe, and a patch/audit/redeployment is in progress. The remaining ~999 trillion fake tokens stay in the attacker’s wallet, posing ongoing dilution risk.
Details
- Date
- May 20, 2026
- Kind
- Hack or exploit
- Method
- Smart Contract Vulnerability
- How in
- Bridge and cross-chain
- Target
- Bridge
- Chains
- not stated
Reported by
Related incidents
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
CashCowCoin 2026 · Hack or exploit · $117K
SwanBluechip, "Butter Bridge hack, May 20, 2026: $180K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htb5c5fcf637/ (data as of 2026-11-01).