On-chain review puts WAX bridge exploit at $90,528

An on-chain reconstruction published October 24 estimates that five unauthorized WAX bridge withdrawals were worth $90,528, about $15,100 more than early figures that counted only stablecoins. The October 22 incident exploited a negative fee parameter, allowing an account with empty mapped-token balances to trigger payouts of USDC on Solana and four assets on Ethereum.

The new estimate matters because it describes a failure in the bridge’s source-chain accounting, not a price move or an attack on the WAX consensus network. It also illustrates a recurring cross-chain risk: a destination-side vault can release real assets after trusting a withdrawal record that does not prove equivalent value was removed on the source chain.

Five withdrawals in 86 seconds

Bitquery’s reconstruction, based on WAX public history nodes and its indexed Solana and Ethereum data, places the five withdrawal requests between 09:46:18 and 09:47:44 UTC on October 22. The requests covered 52,986.497732 WAXUSDC, 21,558.252354 WAXUSDT, 840.2750339 WAXDAI, 2.54669928 WAXWETH and 0.10993227 WAXWBTC.

Each request set the maximum fee to the negative of the withdrawal quantity. The bridge contract calculated the amount charged to the WAX balance as the requested quantity plus that fee, producing a zero debit, while the withdrawal record still specified the full payout. Independent technical analysis by World Programming Society reached the same explanation after examining public WAX history data, though it noted that the actual contract source was not published with the incident reports.

That distinction limits how confidently the implementation can be characterized. The transaction inputs and resulting payouts are publicly observable; descriptions of the precise internal code path are reconstructions from those actions and security-research reports, not a developer-issued postmortem.

How the $90,528 estimate was built

Bitquery valued USDC, USDT and DAI at $1 each. It valued the wrapped ether and wrapped bitcoin at the prices obtained when those assets were exchanged after the withdrawals: about $2,410 per ETH and $81,900 per BTC. Under that method, the three stablecoin payouts total about $75,385, while WETH and WBTC add roughly $15,143, producing the $90,528 estimate.

This is a transaction-window estimate, not an audited loss figure. It covers the five identified bridge payouts on October 22 and uses realized swap prices for the volatile assets. It does not establish WAX’s ultimate financial loss, user reimbursement obligations, recoveries or the identity of the account controller.

Funds moved before the response

Bitquery traced the released assets to deposit addresses that its labels associate with HitBTC. Its timeline puts the interval from the first WAX withdrawal request to the final deposit at 38 minutes. The Ethereum assets were exchanged into approximately 15.58 ETH before moving through an intermediary address; the Solana-side USDC moved separately.

The label-based attribution is not equivalent to confirmation from HitBTC. On-chain records show transfers and wallet behavior, but they do not reveal who controlled the addresses or whether an exchange restricted an account after receiving the deposits.

The same reconstruction found that WAX replaced the contract code 5 hours and 11 minutes after the first withdrawal and later added per-transfer limits. No withdrawal was signed for about 30 hours, after which bridge processing resumed on the afternoon of October 23. Those observations indicate that the affected path was changed and restarted, but they do not substitute for a public audit of the fix or prove that every related vulnerability has been eliminated.