Incident case file
Sign in to watchButter Bridge (MAP Protocol) — Cross-chain Forged Retry / Infinite Mint
0 views
Estimated loss
Victims identified
Investigation
Facts and investigation
Attacker: 0x40592025392BD7d7463711c6E82Ed34241B64279 (EOA recipient; 1 quadrillion MAPO minted from the zero address)
Timeline: On 20 May 2026, Blockaid detected active exploitation of Butter Bridge V3.1 (OmniServiceProxy contract) on Ethereum and BNB Chain. Root cause (via Blockaid): abi.encodePacked collision on dynamic-bytes fields in the bridge's retry path. The attacker initiated a legitimate MAP→ETH message signed via oracle/multisig, directed to a pre-computed contract address with no deployed code (stored as retry entry). The attacker then deployed a contract at this same address, creating a forged retry that passed the guard check. ~1 quadrillion MAPO minted from the zero address to 0x40592025392BD7d7463711c6E82Ed34241B64279 (~4.8 million × the legitimate supply of 208M). ~1 billion MAPO dumped via Uniswap V4 for 52.21 ETH ≈ $180,000 per Blockaid. MAP Protocol / ButterNetwork confirmed the incident, paused mainnet operations, announced patch + audit + contract redeployment. User warning: do not trade MAPO on Uniswap. abi.encodePacked bug on retry path — expected pattern appearing in 3 bridges in 2026.
Sources and coverage
- Articlecryptotimes.iohttps://www.cryptotimes.io/2026/05/21/map-bridge-exploit-1-quadrillion-mapo-minted-in-cross-chain-attack/
- Articlecryptoadventure.comhttps://cryptoadventure.com/map-protocol-token-crashes-after-suspected-infinite-mint-bridge-exploit/
- Articlebeincrypto.comhttps://beincrypto.com/1-quadrillion-mapo-minted-bridge-exploit-crashes-token/
- Articlecryptobriefing.comhttps://cryptobriefing.com/mapo-token-plunges-96-bridge-exploit/
- Articlethecurrencyanalytics.comhttps://thecurrencyanalytics.com/defi/butter-bridge-hack-mints-1-quadrillion-mapo-tokens-wiping-out-nearly-a-third-of-token-value-259299
Victim testimonies
No testimonies yet.
+ Add my testimony → (coming soon)