Loading story…
Saga paused the SagaEVM chain after identifying a security incident involving a coordinated sequence of contract deployments, cross-chain activity, and liquidity withdrawals that resulted in nearly $7 million in assets being moved to Ethereum mainnet. Saga reported the impact was limited to the SagaEVM chainlets Colt and Mustang, while the Saga SSC mainnet and other chainlets remained operational; the company also stated there was no validator compromise, no consensus failure, and no signer key leakage, indicating the broader network remained structurally sound.
Saga said it paused SagaEVM at block height 6593800 to prevent further impact while engineering and security teams validate blast radius using archive data and execution traces, harden affected components, and complete remediation before restart. Saga identified an exploiter wallet 0x2044697623afa31459642708c83f04ecef8c6ecb and is coordinating with exchanges and bridges to blacklist the address and attempt recovery of funds (including USDC, yUSD, ETH, and tBTC); additional protections to deter similar attack patterns were reported as already implemented, with a fuller technical post-mortem planned after remediation.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
In a separate incident noted in reporting on the SagaEVM exploit, Makina disclosed an approximately 11-minute attack that resulted in losses of nearly $4 million. Makina said it was developing and auditing a fix for deployment through a protocol upgrade.
Saga published a security incident investigation update stating that recovery efforts were underway and that additional protections had been implemented. The update also reiterated that the incident did not appear to affect core validator or consensus integrity.
Following the exploit, SagaEVM halted blockchain operations while recovery efforts began. Saga said there was no evidence of validator compromise, consensus failure, or leaked signer keys, and that the broader network remained structurally sound.
SagaEVM suffered a security incident in which an attacker used contract deployments, cross-chain activity, and liquidity withdrawals to steal nearly $7 million in cryptocurrency assets. Saga later said it had identified the attacker’s wallet.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Cosmos EVM balance-reconciliation flaw, tracked as `GHSA-7g4w-cg88-2cq2`, was exploited to drain assets from six Cosmos-based chains. The bug allows an unchecked underflow in a vesting account’s delegated balance to wrap to roughly `2^256`, corrupting reconciliation between EVM state and the Cosmos SDK `x/bank` module and enabling unauthorized minting or burning. Attackers reportedly sold about **$5.72 million** in affected assets through decentralized and centralized exchanges; KiiChain alone reported the theft of 148 million KII, valued at about $9.7 million at the cited price, while an attacker moved 2.99 billion TAC from a TAC account. Cosmos Labs released fixes in Cosmos EVM `v0.6.2` and `v0.7.2` and urged operators of affected public chains to coordinate upgrades or halt block production, as no configuration-only mitigation exists. MANTRA resumed operations using a patched `v8.4.0` binary, while TAC and KiiChain remained halted; KiiChain alleged that public availability of the state-breaking patch before private operator notification created an exploitable window and said two of three upstream defects were still unpatched. Blocking permissionless creation of vesting accounts removes the exploit precondition, but operators still need to deploy the patched releases.
Aug 30, 2026
An exploit against the **Verus-Ethereum bridge** drained about **$11.58 million** in crypto assets, according to reports from Blockaid, PeckShield, and GoPlus. PeckShield said the attacker stole **103.6 tBTC, 1,625 ETH, and 147,000 USDC**, then swapped the proceeds into roughly **5,402 ETH**; the attacker wallet was reportedly seeded with **1 ETH from Tornado Cash**. Security researchers also identified attacker and destination wallets as the theft unfolded. Verus said its network was **halted**, with most block-producing nodes taking themselves offline after the attack’s effects appeared, while developers investigated the root cause and recovery options. GoPlus said the exploit may stem from **cross-chain message validation or signature forgery**, a **withdrawal logic bypass**, or an **access control flaw** in the bridge, which was launched to move assets between the privacy-focused Verus blockchain and Ethereum.
Jun 29, 2026
THORChain disclosed that one of its six Asgard vaults was compromised, enabling unauthorized outbound transactions before the network halted signing activity. Loss estimates ranged from about **$10.7 million** to more than **$11 million**, with stolen assets taken across at least nine blockchains including **Bitcoin, Ethereum, BNB Smart Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP**. Investigators said the attacker initially dispersed funds across multiple chains and later consolidated proceeds into a two-address cluster, while THORChain said automated detection helped stop additional transfers. The root cause remained under investigation, with THORChain examining possible issues in the `GG20` implementation layer as well as potential infrastructure or operational compromise affecting node operators. The protocol paused signing-related churn activity, delaying validator rotation and other operations, and asked operators to review infrastructure, key management, and Bifrost logs tied to the affected vault. TRM Labs said no actor had been attributed at publication time, but urged compliance teams to quickly screen counterparties and flag deposits linked to tagged addresses as the stolen funds continue to move.
Jun 29, 2026