WAX Bridge exploit: negative fee drained about $90K

On 22 October 2026 an attacker sent five withdrawal requests to the WAX Multi-Chain Bridge and took roughly $90K: 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC. The flaw was a missing max_fee >= 0 check in eth.token::withdraw, so max_fee = -quantity made the debit zero while the withdrawal record kept the full amount. WAX paused bridge processing and said the WAX chain and WAXP were not affected.

• About $90K stolen, including roughly $75.4K in stablecoins
• max_fee = -quantity zeroed the debit but the withdrawal record kept the full amount
• The attack came from account fasdfas.al in five transactions on 22 October 2026
• WAX paused bridge processing; the WAX chain and WAXP were not affected