WAX Bridge Exploit: Why Were Stablecoins Affected?

The WAX Multi-Chain Bridge was exploited on October 22, 2026, with estimated losses of approximately US$90,500, according to the SlowMist incident database. The reported vulnerability involved withdrawal logic in the bridge’s smart contract, which connects assets across WAX, Ethereum, and Solana.

Stablecoins were among the assets released from bridge reserves. The problem concerned the accounting of claims and the release of assets between networks. A token trading close to US$1 does not establish that a particular bridge holds enough reserves to meet every withdrawal.

The service’s status has also changed since the initial alert. Through the WAX announcements channel, the project said bridge processing resumed on October 23 at 15:50 UTC, or 22:50 WIB, following a fix and additional safeguards. It also said lost reserves would be replenished. That statement should be distinguished from evidence that reserve reconciliation and all obligations to users have been completed.

The Withdrawal Flaw Broke the Accounting Link

SlowMist identified a fee-validation problem in the withdrawal function. A fee parameter could take a negative value, preventing the expected balance deduction while allowing a withdrawal record to be generated. Bridge components on the destination networks then released assets based on that record.

The failure disrupted the relationship between claims removed on one network and reserves paid out on another. A transaction can complete successfully at a technical level while leaving the underlying economic accounting unbalanced.

Estimated losses from the WAX Multi-Chain Bridge exploit on October 22, 2026. Source: SlowMist Hacked, accessed October 26, 2026. 

Bridge designs vary. Some lock assets and issue representations on another network, while others use burning and minting or liquidity providers. Ethereum’s bridge documentation explains that transfers between networks introduce additional security assumptions.

The connection between transaction evidence and payment must be preserved throughout the process. Security on the source and destination blockchains cannot replace checks on the contracts and verification mechanisms connecting them.

Which Assets Were Reportedly Released?

Research published by BlockintAI on October 24, 2026 identified five withdrawals:

• Approximately 52,986.50 USDC to Solana.

• Approximately 21,558.25 USDT to Ethereum.

• Approximately 840.28 DAI to Ethereum.

• Approximately 2.5467 WETH to Ethereum.

• Approximately 0.10993227 WBTC to Ethereum.

The list includes stablecoins and representations of ETH and BTC. Its scope is broader than the project’s initial description of a small number of affected stablecoins. The difference reinforces the need for a final report detailing the assets, networks, and balances involved.

Token quantities also differ from dollar-denominated losses. USDC, USDT, and DAI target relatively stable values, while the valuation of WETH and WBTC depends on the prices used in the calculation. A loss estimate therefore needs a valuation time and method rather than being treated as an audited final total.

Why Can Stablecoins Be Affected?

The stablecoin label describes a value target. The safety of holding and moving the asset still depends on the structure used. Four separate layers help identify where the risks sit.

A. Issuer Reserves and Redemption

The first layer concerns an issuer’s ability to honor redemption under its product terms. Relevant questions include reserve composition, access to redemption, and which parties are entitled to exchange tokens.

An exploit at a particular bridge is insufficient to establish that a stablecoin issuer’s entire reserve has been depleted. The location of the missing assets and the party responsible for meeting the claim need separate examination.

B. Assets Held by the Bridge

A bridge may hold assets that support token representations on another network. If assets leave without corresponding claims being removed, reserves and liabilities can diverge.

Token holders may face withdrawal problems even while the original stablecoin trades close to US$1. The immediate constraint concerns the bridge’s payment resources or recovery arrangements.

C. The Token Representation on the Destination Network

The same ticker can appear in different structures. Native USDC is issued directly by Circle, while bridged USDC is created through a third party and supported by USDC locked on another network. Circle explains this distinction in its comparison of bridged and native USDC.

Users need to inspect the network and contract address to identify the asset they hold. A name or logo displayed in a wallet does not explain the complete redemption path.

D. Exit Liquidity

An asset holder may still be able to swap tokens while a withdrawal route is disrupted, but the price received depends on available liquidity. Small pools and concentrated selling can increase slippage.

Trading liquidity also differs from reserve adequacy. A token remaining tradable does not establish that the bridge can redeem it in the quantity or timeframe a holder expects.

An Example of a Reserve Shortfall

Consider a bridge holding 100,000 stablecoin units to support 100,000 units of user claims. An exploit then releases 10,000 units without removing the claims that should have been extinguished.

The resulting position would be:

• Remaining reserves: 90,000 units.

• Outstanding user claims: 100,000 units.

• Reserve-to-claim ratio: 90,000 ÷ 100,000 = 90%.

This is an illustration of the mechanism, not a calculation of WAX’s actual reserves. A 90% ratio would not establish that every user must lose 10%. Outcomes would depend on recovered funds, additional capital, settlement arrangements, and claim terms.

The calculation shows why the stablecoin’s price elsewhere does not resolve an internal accounting gap. Reserves must be restored or obligations settled through a process that can be demonstrated.

What Does the Restart Establish?

The announcement that processing resumed is an operational development. The claim that a fix was implemented concerns the technical response, while the commitment to replenish reserves concerns the ability to meet withdrawals. Each requires different evidence.

WAX’s statement that bridge processing resumed on October 23, 2026, at 15:50 UTC, or 22:50 WIB, alongside its reserve-replenishment commitment. Source: WAX Telegram Announcements, update published October 23, 2026, UTC.

The update does not include a token-by-token reserve statement or a reconciliation of all user claims. Readers therefore need to distinguish a recovery commitment from a completed settlement that can be verified.

WAX’s initial statement also said WAXP and the underlying blockchain were technically unaffected. That scope does not establish how WAXP’s price behaved, the security of every application in the ecosystem, or the final outcome of every user position.

What Should Users Check?

Assessment should begin with the asset actually held and the route used to move it:

• Confirm the network, contract address, and whether the token is native or bridged.

• Match instructions against the project’s latest announcements.

• Check whether withdrawals on the relevant route have produced completed destination transactions.

• Look for a remediation report and reserve reconciliation addressing this incident.

• Avoid sharing a seed phrase or private key with anyone offering fund recovery.

The term non-custodial also requires context. A user may control their wallet’s private key while the assets backing a token are held in a bridge contract. Wallet control does not remove exposure to that contract.

Readers seeking a foundation can consult MEXC’s explanation of crypto bridges to understand the relationship between cross-chain transfers, wrapped tokens, and smart contract risk.

The most useful next developments would be details of the fix, security assessment, and evidence of reserves and completed withdrawals. Those disclosures would help establish whether the service’s operational recovery has been accompanied by the settlement of its obligations to users.

Disclaimer

This article provides educational analysis, not investment advice or a guarantee of service security. Loss estimates and recovery status may change. Stablecoins, wrapped tokens, and bridges carry issuer, smart contract, liquidity, and redemption risks that should be assessed for the relevant network and contract.