XBridge Hack

Reported loss $1.9M
Ethereum
Permissionless token-owner overwrite followed by withdrawal of bridge reserves

What happened

SaitaChain's XBridge was exploited on Ethereum after a permissionless token-listing function could overwrite the stored owner of an already listed asset. The attacker then withdrew bridge reserves. Reported loss estimates range from about $1 million to $1.9 million; the $1.9 million shown here is the upper estimate.

Technical root cause

listToken allowed any caller to overwrite _tokenOwner for an already listed asset. withdrawTokens trusted that mutable owner entry, so the attacker could grant itself withdrawal authority over bridge reserves.

How it happened

The attacker paid the listing fee to call listToken for an existing asset, replacing its recorded owner. As the new owner, the attacker called withdrawTokens to remove the bridge's STC reserve. The ownership-overwrite and withdrawal sequence was repeated for other assets including SRLTY and Mazi.

SaitaChain said it was investigating and coordinating with exchanges to block transfers. No source-backed recovery amount has been published.

Protocol details

Classification Access control failure / bridge reserve drain
Protocol Type Exploit/Access control
Category Bridge Hack
Implementation language Solidity
Protocol links Website @XBridge_
Attacker Address 0x0cfc28d16d07219249c6d6d6ae24e7132ee4caa7
Exploit Transaction 0x903d88a92cbc0165a7…8aa9109c92

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks Cross-Chain Bridge Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes