blockintAI · Research blog

Two Small Bridge Hacks in Six Days: WAX Lost About $90K to a Negative Fee, ILITY 4.1M ILY in One Transaction

BlockintAI · 2026-10-24T14:00:00.000Z

Two cross-chain bridges were hit in the week of October 16, 2026. Neither was large. Both are worth reading about, because they show the two most common ways bridges fail: a bug in the code that checks a withdrawal, and a key or server that the bridge trusts.

On October 22, an attacker drained about $90.5K in USDC, USDT, DAI, WETH and WBTC from the WAX Multi-Chain Bridge by sending withdrawals with a negative fee. On October 16, 4,121,791 ILY left the ILITY cross-chain bridge on Base and was sold over about five minutes; ILITY says the attacker went after servers it runs.

We followed the money in both cases on public blockchain data. Times are in US Central Time (CT) with UTC in brackets.

Key facts

WAX Multi-Chain Bridge ILITY bridge
Date Oct 22, 2026, 4:46–5:06 AM CT (09:46–10:06 UTC) Oct 16, 2026, 3:13–3:22 PM CT (20:13–20:22 UTC)
Loss About $90.5K (SlowMist estimate) 4,121,791 ILY, sold for about 52,362 USDC on Base
Cause Withdraw action accepted a negative max_fee (per SlowMist) Attacker targeted Foundation-operated servers, including server-side request forgery (per ILITY)
Chains WAX → Ethereum and Solana Base → Ethereum
Where funds went HitBTC: Hot Wallet 4 (Ethereum, Etherscan tag); HitBTC Hot Wallet (BfP2d) (Solana, Solscan tag) Seven new Ethereum wallets with no Etherscan tag; six sent 20.89 ETH to Arbitrum: Delayed Inbox
Project status Bridge paused; WAXP and the WAX chain unaffected (WAX) Bridge suspended; ILY deposits and withdrawals suspended on exchanges (ILITY)
BlockintAI reports WAX Multi-Chain Bridge exploit ILITY cross-chain bridge breach

WAX: a fee set to minus the withdrawal

The WAX Multi-Chain Bridge lets users move tokens such as USDC and ETH between WAX and other chains. On WAX they're held as wrapped tokens in a contract called eth.token. To leave, a user calls that contract's withdraw action, names a destination address on the other chain, and pays a fee.

According to SlowMist (October 22, 10:23 AM CT), the withdraw action never checked that the fee, a field called max_fee, was zero or more. Setting max_fee to minus the amount made the amount taken from the user's WAX balance zero. The bridge still logged a full withdrawal, and the other side paid it out.

The public WAX chain data matches that account step by step:

  • 4:06 AM CT (09:06 UTC): the account fasdfas.al is created by the account "al" and arrives with a tiny "Welcome to Alcor" transfer of 0.00099536 ETH. Alcor is a WAX exchange.
  • 4:41 AM CT (09:41 UTC): it swaps 0.00024884 ETH of it for 146.28 WAX on Alcor, and at 4:47 AM CT stakes 51 WAX.
  • 4:46–4:47 AM CT (09:46–09:47 UTC): it sends five withdraw actions, each with max_fee set to the negative of the amount:
Withdrawal Sent to
52,986.497732 USDC Solana 4H1piNZ8LsYhZGYhkbJDbPDSghxRj3HWxJqVz5dve8Q7
21,558.252354 USDT Ethereum 0x01664E199991b2F3fe412c2DE5B9b7A0dcDc5070
840.2750339 DAI same
2.54669928 WETH same
0.10993227 WBTC same

Blockaid flagged "an ongoing exploit" at 7:33 AM CT with the same five amounts. SlowMist named the WAX account, the Solana address and the Ethereum address. At the attacker's own swap rates on Ethereum (about $2,410 per ETH), the five withdrawals add up to about $90.5K.

Where the WAX money went

Ethereum. At 5:03 AM CT (10:03 UTC) the attacker's Ethereum address got its gas from the Etherscan-tagged Relay: Depository, a cross-chain payment service. Two minutes later, from 5:05 to 5:06 AM CT, the bridge's Ethereum contract (0x24b22B…70e6) paid out the USDT, DAI, WETH and WBTC in four transactions. The attacker swapped everything to ETH through KyberSwap, 0x and Velora.

At 5:24 AM CT (10:24 UTC) it sent 15.58 ETH to a new address, 0x62907e044ffe22a24aa8794ff2a6ea20598227bb. Nineteen minutes later that address forwarded 15.5799958 ETH to the Etherscan-tagged HitBTC: Hot Wallet 4 (0x80787af194c33b74a811f5e5c549316269d7ee1a). A fresh address that receives funds and forwards them to an exchange's hot wallet within minutes is typical of an exchange deposit address, so the Ethereum half of the haul most likely now sits at the exchange named in that tag. A tag shows where the funds went. It doesn't show who the customer is, and it doesn't mean HitBTC was involved. The attacker's own address is now empty.

Solana. At 5:00 AM CT (10:00 UTC) the bridge's Solana address (8cqv3k…tPcKC) paid 52,986.4977 USDC to the attacker. At 5:12 AM CT the attacker sent 52,986 USDC to a new address, H15JEWrcrp1rTteRoorQTF4e54QF1QmZfxghBcT6ueo9. At 5:51 AM CT that address was swept, with four other addresses in the same transaction, into one collecting address, BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G, which Solscan labels HitBTC Hot Wallet (BfP2d). Many deposit addresses swept together into one exchange-tagged wallet is typical of customer deposits. It doesn't show who the customer is, and it doesn't mean HitBTC was involved.

What WAX says

WAX said at 5:02 PM CT on October 22 that the bridge is paused, that "only a small number of stablecoins" were affected, that WAXP and the WAX chain itself weren't affected, and that the issue was confined to the bridge application contract.

ILITY: 4.12M ILY left in one bridge message

ILITY is a project whose ILY token (0x90eb0e291e9d78a96bfe423b8e616a02c4838cf0 on Base, per the project's GitHub) moves between chains through a bridge the ILITY Foundation runs. ILITY announced a breach and a bridge halt at 4:24 AM CT on October 17.

In a security notice posted on October 22, ILITY said:

  • an attacker drained 4,121,791 ILY of Foundation-supplied liquidity from the bridge,
  • the attacker targeted Foundation-operated servers, using methods including server-side request forgery (SSRF),
  • the stolen ILY was sold on exchanges listing the token between 20:17:17 and 20:22:35 UTC on October 16 (3:17–3:22 PM CT), and the proceeds went to 0x3D1DEA89cbb66Bef7014711aC2ef20fdA1786A7d,
  • user wallets weren't affected, the bridge stays suspended until a security review is done, and law enforcement has been contacted.

What the chain shows

Our on-chain review found how the tokens left the bridge. At 3:13:43 PM CT (20:13:43 UTC) on October 16, the Base address 0x33f69a…2653 called executeSignatures on the bridge's messaging contract (0xa55aad231293ea8ff76692357859a3c366c5d528) (transaction). That call is how a message from the other chain gets carried out on Base. In the same transaction, the bridge's swap router (0x0e03224b483e572566b9ac40ff574018027aace7) sent exactly 4,121,791.1272 ILY to that same address.

That address isn't a stranger to the bridge. Since June 15, 2026 it had submitted 544 earlier messages through the same contract, delivering 104,189.77 ILY in total to 196 other addresses, none of them itself. It had also called the router's collectNativeFees function 19 times. That is the footprint of a wallet the bridge uses to relay messages. On October 16 it submitted two near-identical messages 32 seconds apart, each paying it 4,121,791.1272 ILY; the first failed and the second succeeded. Public data doesn't say who held its key that day. ILITY says the attacker got into servers the Foundation runs, and the chain data is consistent with that, but it doesn't prove it.

From there, the sale is visible on-chain too:

  • 3:17–3:22 PM CT (20:17:17–20:22:35 UTC): eleven swaps of ILY to USDC through KyberSwap on Base, for about 52,361.74 USDC. The window matches ILITY's to the second.
  • 3:23 PM CT (20:23 UTC): the address sent 52,361.740566 USDC and 0.2836 ETH to 0x3D1DEA89…, the address ILITY named.
  • 8:28 PM CT (01:28 UTC Oct 17): 0x3D1DEA89… bridged the USDC through the Basescan-tagged MetaMask: Meta Bridge (the USDC went to the tagged MetaMask: Swap Spender) and, 18 seconds later, received 21.4489 ETH on Ethereum from the Etherscan-tagged Mayan: Swift v2 Destination, a cross-chain swap service.
  • 8:30 PM CT: 21 ETH went to 0x8e9a377ad2f19212326da57f28a70e24383435c4.
  • 10:09 PM CT: 0.4489 ETH on Ethereum and 0.2836 ETH on Base went to 0x9fa184c2bb719f606a8eda14555b0e121f65ca7a, which passed both on to 0x6517f8…c3c7 at 12:22 AM CT on October 17. That last address also received ETH from unrelated senders, so we don't treat it as attacker-controlled.
  • 10:13–10:56 AM CT on October 17: 0x8e9a377a… split its ETH into seven transfers of 0.1 to 4.0 ETH, 20.99 ETH in total, to seven new addresses. None has an Etherscan name tag. Between 10:43 and 11:22 AM CT, six of them sent their ETH (3.0, 3.1, 3.3, 4.0, 4.0 and 3.49 ETH, 20.89 ETH in all) to the Etherscan-tagged Arbitrum: Delayed Inbox, the contract used to bridge ETH from Ethereum to Arbitrum. The seventh sent 0.1 ETH to an older, busy wallet. All seven are now empty. We haven't traced the Arbitrum side.

The ILY sale itself happened on exchanges that list the token, so that part isn't visible on-chain; only the USDC proceeds are.

Watch for lookalike addresses

The histories of the attacker addresses in both cases are full of zero-value and fake-token transfers from addresses that copy their first and last characters, for example a lookalike of the WAX next hop (0x6290…27bb, with the same first and last characters) and one of the ILITY next hop (0x8e97…35c4). These are address-poisoning attempts aimed at anyone who copies an address from a transaction history. They aren't part of either theft. Check every character of an address before sending to it.

What this means

  • Bridges fail at the edges. WAX's bug was a missing check on one field in one action. ILITY's tokens left in a message submitted by an address that had submitted bridge messages for four months. Neither needed a flaw in the tokens themselves.
  • Small hacks still cash out fast. In both cases the money left the first attacker address within an hour and was off the original chain within a few hours, through ordinary public swap and bridge services (named above, from public contract tags and transaction data). Using those services doesn't imply any wrongdoing by them, and Relay only funded the WAX attacker's gas.
  • The trail is public. Both halves of the WAX money reached HitBTC-tagged hot wallets within about an hour (Ethereum at 5:43 AM CT, Solana at 5:51 AM CT), which gives investigators a place to send a request.

If you lost money in a bridge exploit or any crypto theft, report it to ic3.gov and the FTC, and file a report at blockint.ai so others can see the addresses involved.

Sources