Written by Martin Young, Staff Writer. Reviewed by Felix Ng, Staff Editor.
Written by Martin Young, Staff Writer.
Reviewed by Felix Ng, Staff Editor.
Map Protocol token plummets 96% after a quadrillion token mint exploit
Latest NewsPublishedMay 21, 2026
The attacker tricked the Butter Network cross-chain bridge into minting millions more tokens than the legitimate supply of MAPO.
MAPO, the native token of the Map Protocol, fell 96% on Wednesday after an exploit of the Butter Network cross-chain bridge, which allowed an attacker to mint a quadrillion MAPO tokens.
The malicious mint was tens of thousands of times larger than the legitimate supply of tokens, sending the value of MAPO from around $0.003 to $0.0001 in a matter of hours, as reported by CoinGecko.
The attacker used a new externally-owned account (EOA) to dump around a billion MAPO tokens, draining about 52 ETH, worth about $180,000, from Uniswap liquidity pools while retaining nearly a trillion tokens that continue to threaten other pools and potential exchange listings, reported Blockaid on Wednesday.
This latest exploit comes during a month in which at least 18 DeFi and blockchain protocols have been compromised, including THORChain, Verus Protocol’s Ethereum bridge, Transit Finance, TrustedVolumes, Ekubo, Echo Protocol and RetoSwap.
Map Protocol stated the bug was in the Solidity contract layer, and it has paused mainnet and has begun migration while the investigation continues. The Butter Network stated it has paused ButterSwap, adding that user funds were not at risk.
In its latest post, the Map Protocol project stated it would announce a new contract address and select an appropriate time to conduct an asset snapshot. “Any remaining tokens held by attacker-controlled addresses will be fully invalidated and will not be included in any future snapshot or conversion process,” it stated.
A billion MAPO tokens were sent to Uniswap after a quadrillion were minted. Source: Etherscan
The MAPO attacker first sent a legitimate oracle multisig-signed message before deploying a malicious contract at a specific address. The attacker then resent a modified “retry” message that appeared identical in hash but was actually fake. The cross-chain bridge verified it as valid and executed the massive token mint.
No private keys were stolen, and no light clients were broken; it was a classic Solidity vulnerability involving multiple dynamic fields, Blockaid explained.
Related: GitHub investigates unauthorized access to internal repositories
Map Protocol is an omnichain network for swapping Bitcoin, stablecoins and tokenized assets across blockchains, connecting the Bitcoin mainnet with ecosystems such as Ethereum, BNB Chain, Tron and Solana.
TON-TAC issues a post-mortem for $2.68 million exploit
Meanwhile, the TON-TAC asset bridge, a cross-chain bridge designed as a network extension for The Open Network, issued a post-mortem on Thursday detailing its $2.68 million exploit on May 11.
There has been a wave of cross-chain bridge exploits over the past few weeks, including the Verus-Ethereum Bridge, Echo Bridge, and Butter Network’s cross-chain bridge.
The “security incident” stemmed from missing validation in the sequencer software, which accepted a counterfeit wallet on TON that lacked proper code-hash and minter checks, leading to another unauthorized token mint.
Recovery efforts secured about 80% of the affected assets, but the bridge remains paused for an independent audit of the patched sequencer and liquidity restoration, it added.
Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
- Hacks
- DeFi
- Smart Contracts
- Scams & Cybercrime
More on the subject
GitHub investigates unauthorized access to internal repositories
23 hours ago
Martin Young
Echo Protocol’s eBTC exploited for $77M in admin key compromise
May 19, 2026
Martin Young
US law firm files motion requesting redistribution of $344M USDt linked to Iran
May 15, 2026
Vince Quill
GitHub investigates unauthorized access to internal repositories
23 hours ago
Martin Young
Echo Protocol’s eBTC exploited for $77M in admin key compromise
May 19, 2026
Martin Young
US law firm files motion requesting redistribution of $344M USDt linked to Iran
May 15, 2026
Vince Quill
