Incident Overview
On December 6, 2025, waveX protocol detected an abnormal transaction exploiting a vulnerability in their vault-related contract logic, resulting in approximately $430,000 in losses after prompt mitigation; the team immediately initiated investigation and containment procedures, with the impact limited to vault contracts while staking and other components remained unaffected, and waveX has committed to fully compensating all user losses with withdrawals scheduled to resume on December 16, 2025.
The exploit targeted a vulnerability within waveX's vault-related contract logic, though specific technical details of the attack mechanism have not been publicly disclosed. Following detection of the abnormal transaction, the waveX team immediately implemented containment measures that limited the total impact to approximately $430,000, preventing further exploitation. The vulnerability was isolated to the vault contracts, with the team confirming that staking contracts and other protocol components were not compromised.
In response, waveX temporarily restricted certain protocol functionalities to conduct a comprehensive security inspection and is preparing an upgraded version with significantly strengthened security measures and defense mechanisms.
Incident Report
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to WaveX, these are the critical security checks that could have prevented this incident (December 2025).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next WaveX
The WaveX hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.