Web3 Daily Exploits — 23 Oct 2026: WAX ~$90.5K Bridge Negative Fee Zero Debit

The 23 Oct America/Panama window records one first-report protocol incident used for scoring. The WAX Multi-Chain Bridge lost approximately $90.5K after a logic flaw in eth.token::withdraw on the WAX chain allowed an attacker to set max_fee to a negative value equal to the withdrawal quantity. This reduced the actual debit to zero while the contract still recorded a full withdrawal and generated the cross-chain logs that triggered honest releases of the mapped tokens on Solana and Ethereum. SlowMist_Team and Blockaid posted the detections on 22 Oct. Combined live loss on this card is about $0.09M. No other first-report smart-contract exploits with fresh scored loss figures were posted by the required monitors. Continued Tornado Cash deposits by the prior Cysic bridge exploiter, the Solana $kimchi KOL-driven price spike and crash, and disputed CoinDCX wallet movements remain UPDATEs or notes and are not re-scored.

WAX Multi-Chain Bridge — WAX / Solana / Ethereum — about $90.5K — negative max_fee zero debit / unpaid mapped token release

What happened: On 22 Oct 2026 an attacker exploited the WAX Multi-Chain Bridge. The eth.token contract (responsible for mapped tokens WAXUSDC, WAXUSDT, WAXDAI, WAXWETH, WAXWBTC) implements withdraw(from, to_eth_address, quantity, max_fee, chain_name). The debit calculation is quantity + max_fee (or equivalent fee handling). The function did not enforce max_fee ≥ 0. The attacker set max_fee = -quantity (for example -52,986.497732 for a matching USDC quantity). The resulting debit evaluated to zero. Zero-amount paths skipped balance checks and sub_balance, yet the withdrawal was still recorded and bridge logs were emitted. Solana and Ethereum bridge contracts, acting on those logs, released the corresponding real assets: approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC across five transactions. The attacker’s WAX account (fasdfas.al) held zero balances of the mapped tokens throughout. Official WAX statement confirmed the bridge was paused, the issue confined to a bridge application contract, WAXP tokens unaffected, and the chain itself operational. SlowMist reported the loss as ~$90.5K; Blockaid and contemporaneous coverage listed the same asset quantities. Representative example transaction on WAX: 406b76e85ac057ac7322d4bf7ddbea6ac4a2b23539deaa00ea635d17518fb0c9. Attacker addresses: WAX fasdfas.al, Solana 4H1piNZ8LsYhZGYhkbJDbPDSghxRj3HWxJqVz5dve8Q7, Ethereum 0x01664E199991b2F3fe412c2DE5B9b7A0dcDc5070. Victim bridge components: Solana 8cqv3kRg1ivwPNrGGrvJANXb6RPik6XEhnBzs18tPcKC, Ethereum 0x24b22B031Ae1B5a6b09F9a0FD33613a40e0d70e6. Vulnerable contract: eth.token on WAX.

Protocol / chain / asset: WAX Multi-Chain Bridge. Chains: WAX (source debit logic), Solana and Ethereum (release side). Assets: USDC, USDT, DAI, WETH, WBTC released from the destination bridges. The loss stems from missing non-negative enforcement on the fee parameter that zeroed the source-side debit while preserving the full withdrawal amount in the cross-chain message.

Loss: Approximately $90.5K per SlowMist. Asset quantities reported consistently across Blockaid, SlowMist and coverage: ~52,986 USDC, ~21,558 USDT, ~840 DAI, ~2.55 WETH, ~0.11 WBTC. Figures reflect the value of tokens released on Solana and Ethereum without matching payment on WAX. No additional external user-wallet drains outside the bridge reserves are included in the scored total.

Attack type: Logic error / missing validation that max_fee ≥ 0 before adding it into the debit amount. Combined with a fee-check bypass when the resulting fee is zero. Not a classic reentrancy, not an oracle manipulation, and not a private-key compromise of the bridge operators. The honest destination-side release of logs generated by the zero-debit source call made the vector practical.

Explorer URLs: Attacker WAX: https://waxblock.io/account/fasdfas.al. Attacker Solana: https://solscan.io/account/4H1piNZ8LsYhZGYhkbJDbPDSghxRj3HWxJqVz5dve8Q7. Attacker Ethereum: https://etherscan.io/address/0x01664E199991b2F3fe412c2DE5B9b7A0dcDc5070. Victim Solana: https://solscan.io/account/8cqv3kRg1ivwPNrGGrvJANXb6RPik6XEhnBzs18tPcKC. Victim Ethereum: https://etherscan.io/address/0x24b22B031Ae1B5a6b09F9a0FD33613a40e0d70e6. Example WAX tx: https://waxblock.io/transaction/406b76e85ac057ac7322d4bf7ddbea6ac4a2b23539deaa00ea635d17518fb0c9. WAX explorer base: https://waxblock.io/.

Status: First reported 22 Oct by Blockaid and SlowMist_Team. Attack executed on 22 Oct. Official @WAX_io statement: bridge processing paused as precaution, users advised not to submit transfers until confirmed back online, only a small number of stablecoins affected, WAXP unaffected, blockchain operational, issue confined to bridge application contract. No recovery announcement or bounty observed in monitored feeds at cutoff. Users of the bridge should wait for official confirmation before resuming transfers.

Sources: https://x.com/SlowMist_Team/status/2113290086808990182; https://x.com/blockaid_/status/2113247490950696982; https://x.com/WAX_io/status/2113390476225397077.

Also noted

• $kimchi token on Solana (new note, not scored): Lookonchain reported on 23 Oct that KOL @kimchi1x received 500M $kimchi tokens and posted a promotion (later deleted); @a1lon9 reposted then undid the repost. Market cap briefly reached ~$14M before crashing over 95%. Multiple linked wallets bought low and sold high for over $385K combined profit. SlowMist Hacked lists it as a suspected coordinated KOL pump-and-dump rug pull. No smart-contract vulnerability or protocol drain identified; user losses from the price crash are not included in scored live losses. https://x.com/lookonchain/status/2113527634999279887.
• CoinDCX wallet movements (disputed / UPDATE, not re-scored): On-chain activity showed approximately $15.99M USDT and associated TRX moved from wallets linked to CoinDCX. Exchange co-founder stated the addresses were compromised in the July 2025 incident and current wallets were unaffected; some investigators including ZachXBT disputed the accounting and noted continued use of deposit addresses after the prior breach. No confirmed new protocol-level exploit. https://x.com/zachxbt/status/2113264816546873716.
• Cysic bridge exploiter (UPDATE, not re-scored): The address labeled as the Cysic exploiter deposited approximately 300 ETH (~$721K) and 30.4 BNB (~$22.6K) into Tornado Cash. Original incident (unauthorized mint of 10M CYS on BNB Chain around 17 Oct) remains prior; no new scored loss. https://x.com/PeckShieldAlert/status/2113532584588402877.
• Prior items (not re-scored): NEM / NemTokenV2 LP burn (~$820K), Slice FundsModule, institutional MORPHO EIP-7702, Argent-style wallet and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol exploits with fresh scored loss figures beyond the WAX detection.

Sources and references

• SlowMist WAX TI Alert: https://x.com/SlowMist_Team/status/2113290086808990182
• Blockaid WAX detection: https://x.com/blockaid_/status/2113247490950696982
• WAX official statement: https://x.com/WAX_io/status/2113390476225397077
• Example WAX exploit tx: https://waxblock.io/transaction/406b76e85ac057ac7322d4bf7ddbea6ac4a2b23539deaa00ea635d17518fb0c9
• Lookonchain $kimchi report: https://x.com/lookonchain/status/2113527634999279887
• ZachXBT on CoinDCX: https://x.com/zachxbt/status/2113264816546873716
• PeckShield Cysic Tornado update: https://x.com/PeckShieldAlert/status/2113532584588402877
• 22 Oct brief for NEM coverage: https://www.rektradar.xyz/web3-daily-exploits-22-oct-2026-nem-820k-lp-burn-reserve-manip/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is approximately $0.09M from the WAX Multi-Chain Bridge eth.token::withdraw negative max_fee flaw that zeroed the source debit while releasing mapped USDC, USDT, DAI, WETH and WBTC on Solana and Ethereum. The attack was first reported by Blockaid and SlowMist_Team on 22 Oct. No other new first-report protocol drains with fresh figures were posted by the monitored accounts. The $kimchi Solana price crash after KOL posts and disputed CoinDCX wallet flows remain notes and are not re-scored. No how-to or exploit reproduction steps. Stay tuned or stay rekt.