MAPO, the native token of Map Protocol, has experienced a catastrophic collapse of 96% following a sophisticated bridge exploit. According to blockchain security firm Blockaid, attackers exploited the Butter Network cross-chain bridge to mint an enormous amount of unauthorized tokens. The attacker created a quadrillion MAPO tokens through a flaw in the bridge's Solidity contract layer before dumping roughly 1 billion tokens into Uniswap liquidity pools. As reported by Blockaid, the sales drained around 52 ETH, valued at nearly $180,000, while the attacker continued holding close to a trillion MAPO tokens that could still threaten other liquidity pools and exchange markets.
The exploit's impact was immediate and severe, with CoinGecko data showing MAPO falling from about $0.003 to nearly $0.0001 within hours as the exploit overwhelmed the token's legitimate circulating supply. According to Blockaid, the attacker first submitted a legitimate oracle multisig-signed message before deploying a malicious contract at a targeted address. Afterward, the attacker resent what appeared to be an identical 'retry' message, although the payload had been modified. Because the bridge validated the manipulated retry request as authentic, the protocol executed the unauthorized mint and released the newly created MAPO tokens into circulation.
Blockaid described the incident as a 'classic Solidity vulnerability involving multiple dynamic fields' rather than compromised keys or failures in light client infrastructure. The firm noted that the exploit was not tied to stolen private keys or broken cryptographic verification. Additional analysis from Blockaid showed the attacker first submitted a legitimate oracle multisig-signed message before deploying a malicious contract at a targeted address. Afterward, the attacker resent what appeared to be an identical 'retry' message, although the payload had been modified. Because the bridge validated the manipulated retry request as authentic, the protocol executed the unauthorized mint and released the newly created MAPO tokens into circulation.
Map Protocol later confirmed that the issue originated from the Solidity contract implementation rather than compromised keys or failures in its light client infrastructure. The project said it had paused the mainnet and started a migration process while the investigation remains ongoing. In a follow-up statement, the team said a new contract address and asset snapshot timeline would be announced separately. According to the project, tokens controlled by attacker-linked wallets would be excluded from future conversion events and invalidated during the migration process. The project operates as an omnichain network that connects Bitcoin with ecosystems including Ethereum, BNB Chain, Tron, and Solana for cross-chain asset transfers involving Bitcoin, stablecoins, and tokenized assets.
The MAPO exploit represents part of a broader trend of cross-chain bridge vulnerabilities in the DeFi sector. Earlier this week, the Verus Protocol Ethereum bridge lost more than $11.5 million after attackers allegedly used forged cross-chain transfer instructions to siphon reserve assets. According to Blockaid, the Verus incident was compared to the 2022 Nomad Bridge and Wormhole exploits, where fake transfer payloads reportedly tricked protocols into releasing funds. Meanwhile, attacks targeting interoperability infrastructure have continued mounting across decentralized finance, with protocols such as THORChain, Transit Finance, TrustedVolumes, Echo Protocol, Ekubo, and RetoSwap also reporting security incidents in recent weeks. The TON-TAC bridge designed for The Open Network recently reported a loss of $2.68 million, adding to the growing list of bridge exploits this month.
