DeFiLlama’s hacks tracker recorded a $90,500 exploit of the WAX Multi-Chain Bridge on October 22, 2026 The tracker classifies the root cause as missing input validation, meaning the bridge’s
DeFiLlama’s hacks tracker recorded a $90,500 exploit of the WAX Multi-Chain Bridge on October 22, 2026, a bridge that facilitates moving assets between the WAX blockchain and other networks. The tracker classifies the incident under an “Input Validation” category, with the specific technique listed as missing input validation, a flaw in which a smart contract fails to properly check or constrain certain data before acting on it.
Missing input validation is one of the more fundamental categories of smart contract vulnerability, distinct from more complex exploit techniques like flash loan manipulation or reentrancy attacks. In a typical missing-input-validation flaw, a contract accepts a parameter, such as an amount, address, or asset identifier, without adequately verifying that the value falls within expected or safe bounds, creating an opening for an attacker to submit a malformed or unexpected input that the contract then processes in a way its designers never intended.
Cross-chain bridges like WAX’s have repeatedly proven to be among the most frequently targeted categories of decentralized infrastructure, since a bridge inherently needs to coordinate state between two otherwise separate and incompatible blockchain networks, typically by locking or burning an asset on one side and minting or releasing a corresponding amount on the other. Any flaw in the logic governing that handoff, including an insufficiently validated input, can potentially let an attacker extract value without providing legitimate collateral on the other side of the bridge.
At $90,500, the WAX Multi-Chain Bridge incident is a comparatively small exploit relative to some of the larger bridge hacks that have struck the broader crypto industry over the years, several of which have resulted in losses well into the tens or hundreds of millions of dollars. DeFiLlama’s broader tracker shows more than $2.3 billion lost across over 300 separate tracked incidents so far in 2026, giving the WAX incident useful context as one relatively minor entry within a much larger pattern of ongoing security incidents across the decentralized finance industry.
No postmortem or detailed incident report from the WAX team accompanied the DeFiLlama listing at the time of this report, leaving the dollar figure and technical classification from DeFiLlama’s own tracker as the most complete publicly available account of what happened. The hacks tracker, maintained by DeFiLlama, noted the incident alongside its running total of 2026 security losses across the broader decentralized finance industry.
This post first appeared in A Missing Input Check Cost the WAX Multi-Chain Bridge $90,500
