Incident Overview
On January 21, 2026, SagaEVM suffered a security incident involving coordinated contract deployments and cross-chain operations, resulting in approximately $7 million in USDC, yUSD, ETH, and tBTC being transferred to Ethereum Mainnet.
The attack involved a coordinated sequence of malicious contract deployments on SagaEVM, followed by cross-chain bridging operations that moved assets off the chain. The attacker systematically deployed contracts, executed cross-chain transactions, and withdrew liquidity totaling approximately $7 million in various assets including USDC, yUSD, ETH, and tBTC. These stolen funds were then bridged to Ethereum Mainnet and consolidated into the attacker's identified wallet address.
Upon detecting the suspicious activity, Saga's engineering and security teams immediately halted the SagaEVM chainlet at block height 6,593,800 to prevent further exploitation. The incident was isolated to the SagaEVM chainlet and specific related chains (Colt and Mustang), with no evidence of consensus failure, validator compromise, or signer key leakage. Saga emphasized that the broader network infrastructure, including the Saga SSC mainnet, protocol consensus layer, validator security, and other Saga chainlets remained structurally sound and operational throughout the incident.
The team initiated a full forensic investigation using archive nodes and execution traces, introduced additional safeguards against similar coordinated attack patterns, and began coordinating with exchanges and bridge providers to blacklist the exploiter's wallet and attempt asset recovery.
Exploiter Wallet (Ethereum): 0x20446976…8c6ecb
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Saga, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to Infinite Mint and Dump / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Saga
The Saga hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.