A minus sign drained the WAX bridge. The stolen coins reached HitBTC in 38 minutes

01 · What happenedThe WAX bridge paid out, and the coins went to HitBTC

On 22 October, the WAX bridge paid about $90,500 to someone who put nothing in. WAX is a blockchain built for games and NFTs. Its bridge moves dollars and other coins between WAX, Solana and Ethereum. Within 38 minutes, almost all the money had reached HitBTC, a crypto exchange.

The trick was a minus sign. To move coins out, you tell the bridge how much to send and the most you will pay as a fee. Your balance is charged the amount plus the fee. The thief set the fee to minus the amount, so the charge came to zero. The bridge paid out anyway.

Bitquery traced the whole theft. We read every step of it and followed the payouts with Bitquery's Solana and Ethereum data. The stolen coins went into HitBTC through two deposit addresses, the one-off addresses an exchange gives each user. The wallet that paid the thief's network fees got its first ETH on Ethereum from Tornado Cash, a mixer that hides where coins came from. Five hours after the theft, a second account tried the same trick and failed. And the loss is bigger than first reported, because the early figure counts only the stablecoins.

02 · How the bridge worksCopies on WAX, real coins in a vault

Coins can't jump between blockchains on their own. A bridge keeps the real coins in a vault on one chain and gives you a copy on the other. On WAX the copies have names like WAXUSDC and WAXUSDT. Each one is meant to be backed by a real coin in the bridge's vault on Solana or Ethereum.

Going back is the reverse. You call withdraw, name your address on the other chain and set a fee cap. The copies come out of your balance. Then the bridge's signer, the account that approves every payout, signs the withdrawal, and you claim the real coins from the vault.

Since June, all 446 withdrawals by other accounts set the fee to zero. In the bridge's full record, more than 3,100 withdrawals going back to March 2021, nobody had tried a fee below zero before 22 October.

03 · The bugA fee below zero

The withdraw function added the fee to the amount and took the total from the user's balance. It assumed the fee would be zero or more. It never checked. So a fee of minus the full amount makes the total zero, and nothing is charged.

GoPlus Security, a blockchain security firm, set out the bug in a post on 23 October. Its text says the attacker set the fee "to quantity". The thief's own calls show a negative fee. So does the screenshot in GoPlus's post. These are the five withdrawals.

The thief opened each WAXUSDC, WAXUSDT or other balance in the same second as its withdrawal. All five balances still read zero.

04 · 86 secondsFive withdrawals took most of every vault

The thief's WAX account, fasdfas.al, was 40 minutes old when it struck. It was opened by an account called al, which also sent it a "Welcome to Alcor" gift of about $2 in wrapped ETH. Alcor is a DEX on WAX. The thief swapped part of the gift for WAX tokens, and that was all the setup it needed on that side.

Then the thief struck: USDC to Solana, then USDT, DAI, WETH and WBTC to Ethereum. Between the first and second withdrawals it staked some of its tokens for CPU, the network time every account on the chain needs. All five went out in 86 seconds, and the bridge signed each one in less than a minute.

Each withdrawal took most of that coin's vault, from 81% of the DAI to almost all the WBTC.

Nothing stopped a single withdrawal that large. That afternoon, WAX set its first ever limits on these five coins. The thief's USDC withdrawal was 21 times the new USDC cap.

05 · What was taken$90,500, and not only in stablecoins

With stablecoins at $1 and the rest at the thief's own swap prices, the five withdrawals were worth about $90,500. More than half of that was the USDC on Solana.

WAX told users on X that the exploit hit "a small number of stablecoins". The early press figure, for example in The Crypto Times, matches the stablecoins alone. That leaves out two coins. The WETH and WBTC add about $15,100 more.

06 · 38 minutesFrom WAX to HitBTC

The bridge had paid, but the coins still had to be claimed on each chain, and that takes gas, the small fee paid on every transfer. Both of the thief's new wallets were empty, so about 12 minutes in, the Solana wallet got a little SOL through Relay, a service that moves coins between chains. Two minutes later it claimed the USDC. On Ethereum, ETH for gas landed three minutes after that, and the wallet claimed the other four coins straight away.

Then the money moved to HitBTC. The Solana wallet sent its USDC to a HitBTC deposit address. The Ethereum wallet swapped the other four coins for ETH, mostly through the KyberSwap and Velora routers. It sent 15.58 ETH to a second deposit address, 38 minutes after the first withdrawal.

07 · Where the money wentDeposit addresses, then HitBTC's hot wallets

An exchange gives each user a deposit address, then sweeps it into a hot wallet, the working wallet it pays users from. Both deposits were swept within the hour. Our address labels mark the Ethereum hot wallet as HitBTC's, and that wallet has taken ETH from 145,899 senders in more than two years. On Solana the deposit went to a collector wallet that passes all of it on to a wallet our labels mark as HitBTC's.

Two more deposits reached HitBTC that morning from wallets tied to the thief. Neither was stolen from the bridge. One sent USDT on BNB Chain. The other sent SOL on Solana, mostly money from Artrade (ATR) tokens it had sold two hours earlier. Counting the stolen coins, about $115,600 went into HitBTC in four deposits.

An exchange can usually match a deposit address to the account that owns it, so the next step in this trail sits with HitBTC. Whether it has frozen anything is not something the chain shows, because the coins already sit in its own wallets.

08 · The gas walletTornado Cash at both ends

The gas for both claims came from one wallet, 0x9a99…07be, which the thief used on Ethereum, Arbitrum and BNB Chain. Its first ETH on Ethereum came out of Tornado Cash's 0.1 ETH pool, three hours before the theft. Tornado Cash pools many people's coins, so no one can tell whose coins come out. We looked at who uses it in our Tornado Cash audit.

A minute after that Tornado withdrawal, the gas wallet bridged a little ETH to a Solana wallet. Over the next three hours it gathered about $3,200 in USDT on BNB Chain. Part came from its own funds on Arbitrum through Relay, and the rest arrived through HOT, another bridge, from a wallet we did not trace. That USDT paid for the gas. Relay's public records name this wallet as the sender of the gas to both of the thief's receiving wallets.

Within an hour of the theft, the gas wallet sent 0.1 ETH back into Tornado Cash and its USDT to HitBTC. The record shows these wallets moving together, often to the second, from the Tornado withdrawal to the last deposit at HitBTC almost four hours later. It does not show who controls them.

09 · A copycat, then a fixA second account tries, and WAX closes the hole

Five hours after the theft, a second WAX account, lq52153yyb5r, tried the same trick. Unlike the thief's account, it was 11 months old. It started small, with 1 USDC. On its second try it set a fee of minus 2 on a 1 USDC withdrawal, and its balance went up instead of down. So the bug could also make WAXUSDC out of nothing.

The bridge never signed the copycat's four tries, so nothing reached Solana. WAX replaced the contract's code four minutes after the copycat's last try. It added the transfer limits an hour and a half later, and that night it told users on X that it had paused the bridge.

No withdrawal was signed for 30 hours. The bridge started signing again on the afternoon of 23 October, beginning with the requests left over from the day before.

10 · What it meansWhat the WAX bridge hack means for users and other bridges

For WAX users, the bridge works again. Each transfer now has a cap. WAX says its own coin, WAXP, and the chain itself were not affected. If you bridged out on 22 October and your coins have not arrived, follow WAX's own channels. Do not pay anyone who offers to recover them.

For other bridges, this hack needed no stolen key and no clever code. It needed one number the contract trusted. A user can type a negative fee, so the contract has to check for one. The new caps would have held the USDC withdrawal to under 5% of what the thief took. We have looked at other thefts that crossed chains, such as the KelpDAO bridge hack and the SingularityNET hack.

On the same day, someone drained Arkadiko on Stacks through a vote, and that thief was also funded from Tornado Cash. We traced it in the Arkadiko hack.

11 · How we traced itMethod and limits

We read every action of the two accounts, the bridge and its token contract from public WAX history nodes. Then we followed the payouts on Solana, Ethereum and BNB Chain with Bitquery's data. We checked each hop between chains against Relay's public records. Our labels named the exchange, the mixer and the swap routers. The prices come from the thief's own swaps.

Any Solana, Ethereum or BNB Chain wallet here can be followed with the Bitquery MCP. It lets you ask an AI assistant where a wallet's money went. The full histories are also sold as files, as the Solana, Ethereum and BNB Chain datasets. Bitquery also does this work for clients through its crypto investigation services. We traced the CoinDCX hack the same way.

12 · The addressesWhere to look

These are the main accounts, wallets and transactions in this story.

FAQ

Was the WAX bridge hacked?

Yes. On 22 October an account on WAX withdrew USDC, USDT, DAI, WETH and WBTC through the bridge without paying for them. It set each withdrawal's fee to minus the amount, so its balance was charged nothing, and the bridge paid out on Solana and Ethereum.

How much was stolen in the WAX bridge hack?

About $90,500, with stablecoins at $1 and the rest at the thief's swap prices. Stablecoins made up most of it, and WETH and WBTC added about $15,100.

Where did the stolen funds go?

To HitBTC, a crypto exchange, within 38 minutes. The USDC went into a deposit address on Solana, and the other coins were swapped to ETH and sent to a deposit address on Ethereum. Both deposits were swept within the hour, and the coins went on to wallets our labels mark as HitBTC's.

Can HitBTC freeze the stolen funds?

An exchange can usually tie a deposit address to one customer account, and law enforcement can ask it to act. Whether HitBTC has frozen anything does not show on-chain, because the coins were already in its own wallets.

Is the WAX bridge working again?

Yes. It started signing withdrawals again on the afternoon of 23 October, with a new limit on each transfer.