Meter.io — Passport Bridge Block Validation Exploit (September 2026)
Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 18 to 6. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·wrKaCh…6C22Summary
On September 23, 2026, an attacker exploited a block validation vulnerability on the Meter mainnet to mint approximately $2.3 million in unbacked wrapped MTRG (wMTRG) tokens via the Meter Passport bridge on BNB Chain, then sold a portion on PancakeSwap. Meter paused its mainnet and Passport bridge in response, warned users against all MTR/MTRG transactions, and disclosed that transactions after block 100731417 may not be honored during recovery. This is the second major exploit of the Meter Passport bridge infrastructure; the first, in February 2022, resulted in approximately $4.4 million in losses.
Connected Entities
2 entities1 submission awaiting moderator review.
Timeline(6 events)
5 February 2022
First major Meter Passport exploit: attacker exploits a 'wrong trust assumption' in bridge smart contract code, minting approximately $4.4 million in BNB and wETH. Hundred Finance suffers an additional ~$3.3 million in cascading losses. Meter commits to reimbursing affected parties.
CoinTelegraph23 September 2026
Second Meter Passport exploit begins at 21:14 UTC (some sources report 18:14 UTC). Attacker exploits a block validation vulnerability on the Meter mainnet to mint approximately $2.3 million in unbacked wMTRG across roughly two transactions on the BNB Chain bridge.
CoinGabbar / CryptoNews.net23 September 2026
Attacker sells portion of illicitly minted wMTRG on PancakeSwap. MTRG price begins to collapse, ultimately falling approximately 71.7% from $0.00991494 to $0.002682.
CoinGabbar24 September 2026
Security firm Blockaid issues public alert identifying the ongoing attack on Meter Passport's BNB Chain deployment. KuCoin relays multiple Blockaid flash alerts. Meter pauses mainnet and Passport bridge.
KuCoin News (Blockaid alerts)24 September 2026
Meter publicly discloses two attacker wallet addresses, warns users against all MTR/MTRG transactions, and states that transactions after block 100731417 may not be honored. Team announces it is working with exchanges, security firms, and law enforcement. A 10% white-hat bounty is reportedly offered to the attacker.
CryptoNews.net / CoinGabbar24 September 2026
Crypto Times, Phemex News, and CoinGabbar publish incident reports. No recovery timeline or user compensation plan announced. Post-mortem not yet published.
Crypto TimesDecision Log
- slot 462172170 · hash 7ktMsFJYsZY1ZMXvAXFwYGVw3YRqpdMiq9iiaFpzXYR4
- slot 462172165 · hash 7eRDB284FFmzFhdeVSySnmjk7crdQtFfbFe9f8U6hzNs
- slot 450416372 · hash 94r5eWUgArs1haWmwDJ6vK25KcXAaTWVQrYXwiwb7z7V
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 12 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/25/2026, 5:04:17 PM
last updated: 10/27/2026, 6:28:27 PM
5 viewsavoid.net — verified advice for a post-truth world