MAP Protocol Hack

Reported loss $110K
Ethereum BNB Chain
Infinite Mint

What happened

On May 20, 2026, an attacker exploited MAP Protocol's Butter Bridge V3.1 OmniServiceProxy, causing unauthorized MAPO minting on Ethereum and BSC. Approximately $110,000 in value was realized by dumping part of the minted supply; MAP Protocol paused the bridge and announced a migration and user-protection plan.

Technical root cause

Butter Bridge V3.1 verified retry messages using a packed hash over dynamic fields; a CREATE2-deployed contract and rearranged message fields produced a collision with an already accepted message, allowing the retry path to mint MAPO without a matching source transfer.

How it happened

The attacker used a legitimate bridge message and a crafted retry path to mint one quadrillion MAPO on Ethereum without a corresponding source-chain lock or burn, then sold part of the minted supply into liquidity pools.

Protocol details

Classification Token & Share Accounting
Protocol Type Chain
Category Bridge Hack
Implementation language Solidity
Protocol links Website @MapProtocol

Market Context at Time of Hack

Token Price at Hack $0.00308137
Market Cap at Hack $19.1M
Reported loss / token market cap 0.58%
Token Categories
DeFi Interoperability Ethereum Ecosystem BNB Chain Ecosystem Bitcoin Ecosystem MAP Ecosystem
Protocol Links
GitHub Reddit

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes