The WAX Bridge Exploit Was a One-Number Failure With a Cross-Chain Exit

An unchecked negative fee reduced the user's charge to zero while the bridge released real assets. Editorial illustration; not a transaction trace.

Executive summary

On 22 October 2026, a newly created WAX account withdrew approximately $90,528 in five assets from a WAX bridge while putting up effectively nothing. The exploit was neither a stolen-validator-key story nor an advanced cryptographic break. According to a detailed Bitquery reconstruction published and verified on 24 October, the withdrawal logic accepted a fee equal to the negative of the requested amount. The amount charged to the WAX-side balance therefore became zero, yet the bridge's payout process still released real USDC on Solana and USDT, DAI, WETH and WBTC on Ethereum.

The sequence took 86 seconds. The USDC withdrawal removed 97% of that Solana vault; the Ethereum withdrawals removed between 81% and effectively all of the corresponding DAI, USDT, WETH and WBTC balances. The assets then moved through swaps and deposit addresses. Bitquery attributes the destination to HitBTC and reports that the last stolen value reached a deposit address 38 minutes after the first withdrawal. Public Ethereum transactions independently show the published receiving wallet calling the bridge vault four times, conducting approvals and swaps, and finally sending 15.58 ETH to the address identified in the reconstruction as the exchange deposit address.

Our thesis is that this incident is best understood as a failure of control composition. One missing lower-bound check created the opening. A signer authorized economically impossible payouts instead of independently recomputing the withdrawal invariant. The absence of per-transfer limits allowed one request to consume nearly an entire asset vault. Each weakness mattered; together they converted a trivial arithmetic input into a cross-chain solvency loss.

That distinction has institutional consequences. Bridges should not be assessed only by the sophistication of their cryptography, validator set or audit history. Their security also depends on mundane boundary checks, the policy intelligence of off-chain signers, and exposure controls that remain effective when application logic is wrong. WAX's subsequent code replacement and transfer caps address important symptoms, but a durable response must show why the authorization layer accepted a zero-funded claim and how independent controls will prevent the next malformed request from becoming a real payout.

What is established—and what is not

The most reliable way to analyze a cross-chain incident is to separate observations by domain. A wrapped claim on WAX, an Ethereum ERC-20 in a vault and native ETH after a swap are related through a bridge process, but they are not the same object and should not be counted as independent supplies.

This report does not claim to have directly measured the originating WAX actions through HyperSync; WAX is not covered by the approved query. Nor does it reproduce the Solana leg. Its companion evidence examines only the Ethereum receiving wallet over a fixed block interval. Transaction calldata shows direct contract interactions, but it does not by itself prove the identity behind an address, recover every internal transfer, or establish whether an exchange took action.

That restraint matters because cross-chain investigations often blur three different statements: an asset moved, a service likely received it, and a person or organization controlled the service account. The first may be a ledger fact. The second can be a well-supported attribution. The third usually requires off-chain records.

The exploit path: valid syntax, impossible economics

The bridge model described in the reconstruction is straightforward. Users held WAX-side representations such as WAXUSDC. A withdrawal named an external-chain destination and a maximum fee. The user's WAX balance should have been reduced by the amount plus the fee; after approval by the bridge signer, the corresponding real asset could be claimed from a vault on Ethereum or Solana.

The vulnerable path implicitly assumed that the fee could not be negative. Set the fee to the negative of the withdrawal amount, however, and the debit becomes zero. The request can remain syntactically acceptable while becoming economically impossible: it asks the vault to release value without extinguishing the corresponding claim.

flowchart LR
    A[WAX-side represented balance] --> B[Withdrawal request]
    B --> C{Validate amount and fee?}
    C -->|Missing lower bound| D[amount + negative fee = 0]
    D --> E[Bridge signer authorizes]
    E --> F[Real asset released on Ethereum or Solana]
    F --> G[Unbacked WAX-side claim remains]
    C -->|Reject negative fee| H[No payout]

The attacker used the flaw five times: 52,986.497732 WAXUSDC, 21,558.252354 WAXUSDT, 840.2750339 WAXDAI, 2.54669928 WAXWETH and 0.10993227 WAXWBTC. According to Bitquery, each balance was opened in the same second as its withdrawal and remained at zero. The bridge paid anyway.

This is why calling the event merely an “input-validation bug” is incomplete. Software defects are inevitable; security architecture determines whether they become catastrophic. The signer was a second decision point. It could have checked that the withdrawal burned or debited sufficient WAX-side value, that the fee was non-negative, and that the requested amount was proportionate to recent activity and remaining reserves. Instead, it appears to have treated the application request as authoritative.

The vaults supplied a third decision point. Before the incident, no per-transfer limit stopped a withdrawal of 52,986 USDC or almost all of the WBTC. Bitquery reports that WAX later imposed limits and that the stolen USDC amount was 21 times the new cap. A cap would not have fixed the underlying arithmetic, but it could have converted a near-total drain into a smaller, detectable loss.

A resilient bridge assumes any one layer can fail. Independent controls should make the same malformed request harmless at multiple stages.

From bridge claim to liquid assets

The five withdrawals began at 09:46:18 UTC and finished 86 seconds later, according to the reconstruction. The receiving wallets initially lacked the native gas assets needed to claim and move tokens. Funding arrived; the Solana wallet claimed USDC, while the Ethereum wallet claimed USDT, DAI, WETH and WBTC from the published bridge vault.

The approved Ethereum observation contains 17 direct transactions involving the published receiving wallet between blocks 26,247,000 and 26,250,999. Four consecutive calls to the bridge vault appear at blocks 26,247,443 through 26,247,446. The wallet then approved and interacted with swap routers. At block 26,247,536 it transferred 15.58 ETH to the address that Bitquery identifies as a HitBTC deposit address. This on-chain sequence supports the narrow research question: the Ethereum-side claims, conversion activity and final native-ETH transfer occurred in a tight interval.

It does not establish the entire loss. The $52,986 USDC payout occurred on Solana and made up more than half of the reported value. Excluding that leg from the query is a coverage limitation, not evidence that it did not happen. Likewise, the Ethereum transaction list should not be used to reconstruct precise dollar proceeds without decoding internal router transfers and applying defensible asset prices. Price movement would not prove exploit flow or causation, so market-price data are deliberately absent.

sequenceDiagram
    participant W as WAX account
    participant S as Bridge signer
    participant V as Ethereum vault
    participant R as Receiving wallet
    participant X as Swap routers
    participant D as Reported exchange deposit
    W->>S: Five withdrawal requests with negative fees
    S->>V: Authorize four Ethereum payouts
    V->>R: USDT, DAI, WETH and WBTC claims
    R->>X: Approvals and asset conversions
    X-->>R: Native ETH proceeds
    R->>D: 15.58 ETH
    Note over W,D: First withdrawal to final reported deposit: 38 minutes

The destination attribution deserves careful wording. Bitquery says the Ethereum deposit address swept funds to a wallet in its label system associated with HitBTC; it also describes exchange-like deposit and sweep behavior. That is meaningful forensic evidence. But a public chain cannot reveal the exchange customer, determine beneficial ownership, or show whether an internal account was frozen after the sweep. Those questions sit with the exchange and, potentially, law enforcement.

The response: fast containment, incomplete assurance

The response timeline suggests meaningful operational intervention. Bitquery reports that a second WAX account attempted the same pattern about five hours later. One attempt used a fee of minus two against a one-USDC withdrawal, which apparently increased the WAX-side balance by one. The bridge signer did not approve the copycat's requests, so no Solana payout followed. WAX replaced the contract code four minutes after the last copycat attempt—five hours and 11 minutes after the original exploit—and added per-transfer limits about 90 minutes later.

No withdrawals were signed for roughly 30 hours. Signing resumed on the afternoon of 23 October, beginning with pending requests. WAX's public notice said the bridge was paused and that native WAXP and the WAX blockchain were unaffected. These actions reduced immediate exposure and restored service, but they are not equivalent to a complete post-mortem.

For users and counterparties, the unanswered questions are governance questions as much as coding questions:

• What exact invariant must a signer verify independently of the originating contract?

• Can a signer halt automatically when a withdrawal consumes an abnormal share of a vault?

• Are limits calibrated per asset and over time, rather than only per transaction?

• Who can change signer policy, bridge code and limits, and how quickly can those powers be exercised?

• How are liabilities on WAX reconciled against assets held on every destination chain after an incident?

• Will the operator publish transaction-linked accounting for losses, recovery and any user reimbursement?

The distinction between containment and assurance is central. A patched inequality blocks the known negative-fee input. A cap reduces the damage of a large request. Neither proves that other combinations of amount, precision, asset identifier or destination cannot violate the same conservation principle. Assurance requires tests and monitoring built around economic invariants, not only the input that happened to be exploited.

Implications for bridge operators and allocators

First, signer systems should be policy engines, not blind relays. If the signer merely confirms that an application emitted an expected request, the bridge has duplicated the same trust assumption instead of adding defense in depth. Authorization should recompute the debit, verify that the relevant representation was burned or locked, check the destination and asset mapping, and compare the payout with live reserves.

Second, solvency controls should operate across time horizons. Per-transaction caps are useful, but an attacker can split a drain into many smaller claims. Bridges need velocity limits, cumulative outflow thresholds, reserve-share alerts and circuit breakers. The signal in this incident was not subtle: five new balances, five unusually large withdrawals and depletion of 81% to nearly 100% of five vaults within seconds.

Third, cross-chain asset accounting must avoid false addition. WAXUSDC represented a claim on USDC held elsewhere; it was not a second, independent pool of dollar backing. When the vault released USDC without removing the corresponding WAX claim, the system did not create harmless “extra volume.” It created an undercollateralized liability. Risk reporting should reconcile claims and reserves by canonical asset, chain, vault and redemption path.

Fourth, liquidity is part of incident severity. The attacker did not need to wait for an obscure wrapped token market. The bridge released established assets on liquid chains; the Ethereum assets could be converted into ETH and sent onward within minutes. A bridge's risk is therefore a function of both vulnerable value and exit speed. Small vaults can still be almost fully impaired before a manual committee reacts.

Finally, public data improve accountability but do not eliminate the need for disclosure. The Ethereum leg is reproducible; the WAX history and Solana trail have been reconstructed; the addresses and timings can be challenged. Yet users still need an operator-level explanation of the authorization failure, the final liability position and remediation coverage. An independent trace is evidence, not a substitute for accountable incident governance.

Counterarguments and proportionality

The absolute loss—about $90,500—is small relative to the largest bridge incidents, and WAX appears to have replaced code, added limits and resumed signing quickly. It would be disproportionate to infer that the WAX base chain failed or that all bridged assets remain impaired. The available evidence specifically says native WAXP and consensus were not affected.

It is also possible to argue that the failed copycat shows effective human intervention: once alerted, the signer stopped authorizing malicious requests. That is fair. But it reinforces the deeper point. The same signer that became an effective containment layer after detection was not an effective preventive layer before it. Institutional assessment should ask whether the control now operates automatically and independently, rather than relying on an operator recognizing a familiar exploit in time.

The HitBTC attribution should likewise remain qualified. Deposit sweeps and labeled hot wallets are useful indicators, not judicial proof. No public-chain observation establishes whether HitBTC knew the origin of the funds when they arrived, who owned the credited account, or what happened internally afterward.

Conclusion

The WAX bridge incident is important precisely because the initiating bug was simple. A negative number canceled a withdrawal debit. The security failure was larger than that line of logic: the signer accepted the request, the vault permitted near-total depletion, and liquid destination assets enabled a rapid exit.

The lesson is not that bridges need ever more elaborate cryptography. It is that bridge solvency must survive ordinary software mistakes. Validation should reject impossible inputs; authorization should independently enforce conservation; exposure limits should contain what slips through; and accounting should reconcile each represented claim with its redeemable reserve across chains.

WAX's patch and limits are meaningful containment. The next standard of proof is stronger: a transparent account of why the signer authorized zero-funded withdrawals, how cross-chain liabilities were reconciled, and which controls now fail safely when the application layer does not. Until then, the chain record can show the money's path, but not that the bridge's control architecture has been fully repaired.

Sources

• Bitquery, “A minus sign drained the WAX bridge” (24 October 2026)

• WAX incident notice (22 October 2026)

• GoPlus Security analysis (23 October 2026)

• Ethereum receiving wallet on Etherscan

• Published Ethereum bridge vault on Etherscan

• Alcor/WAX bridge interface