← Meter.io — Passport Bridge Block Validation Exploit (September 2026)reviewed 2026-10-27 · 16 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Meter.io — Passport Bridge Block Validation Exploit (September 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in section: Incident Overview
“ A third address — 0xEe2EEEED4Ed8580669ED924abEb49f27f7D0Bd65 — was flagged by Blockaid and attributed to the exploiter.”
reviewerA third attacker address was flagged by Blockaid; it is the same address as the first one, differing only in letter caseThe 'third' address is the first address in checksum-cased form, so it is a duplicate. No source fetched attributes any address to Blockaid. - #2[disputed][awaiting moderator]in section: Incident Overview
“https://etherscan.io/address/0x8d3d13cac607B7297Ff61A5E1E71072758AF4D01”
reviewerEtherscan address 0x8d3d...4D01 is cited as the Meter Passport bridge exploiter for the September 2026 incidentThe source is the 2022 exploiter and is attached to the 2026 incident overview. It does not back any 2026 claim and should be removed or moved to the 2022 section. The same URL is in sources_used[6].
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #8[unverifiable][awaiting moderator]in section: Technical Mechanism
“The affected bridge contract address reported by Blockaid was 0xbd2949f67dcdc549c6ebe98696449fa79d988a9f.”
reviewerBridge contract address reported by Blockaid is 0xbd2949f6...No fetched source gives this address. The Crypto Times page was not readable (403). - #11[unverifiable][awaiting moderator]in section: Market and Price Impact
“Phemex News reported MTR declining approximately 9.67% and MTRG approximately 13.79% at the time of their article”
reviewerPhemex reported MTR down ~9.67% and MTRG down ~13.79%Not visible in the fetched text. A separate search snippet reports MTR near -80% and MTRG near -75% within 24h. - #14[unverifiable][awaiting moderator]in section: Meter Team Response and Recovery
“The Crypto Times noted it had not received an official comment from Meter at the time of publication.”
reviewerCrypto Times had not received official comment from MeterThe fetch returned 403, so the claim could not be checked. This is not scored against the page.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Incident Overview
“the attack began on September 23, 2026 at 21:14 UTC”
reviewerAttack began 23 Sept 2026 at 21:14 UTCSupported by CoinGabbar only. CryptoNews.net gives 18:14, so the time is uncertain; the page's attribution to 'Meter's own public communications' is not shown by either article. - #4[partially supported][awaiting moderator]in section: Incident Overview
“The exploit was detected by security firm Blockaid on September 24, 2026 (UTC+8).”
reviewerBlockaid detected the exploit on September 24, 2026 (UTC+8)The page claims detection was on Sept 24, but the attack began Sept 23 at 21:14 UTC, which is already Sept 24 at UTC+8. The detection time itself is not stated. - #7[partially supported][awaiting moderator]in section: Technical Mechanism
“The attacker exploited this vulnerability to mint unbacked MTR and MTRG tokens on the Meter mainnet, then leveraged the Passport bridge's cross-chain channel to create corresponding unbacked wMTRG on BNB Chain.”
reviewerRoot cause was a block validation vulnerability on Meter mainnet, with unbacked MTR and MTRG minted on mainnet and bridged to BNB ChainThe block validation flaw is reported by secondary outlets only. The mainnet-then-bridge sequence is the page's inference, and no post-mortem exists. - #16[partially supported][awaiting moderator]in section: Pattern of Repeat Vulnerability: February 2022 Precedent
“raises questions about the thoroughness of Meter's ongoing security posture and audit coverage”
reviewerNo audit report addressing the vulnerability class had been identified; the recurrence raises questions about Meter's security postureThis is editorial inference with no cited source. It is also not clear the two exploits share a vulnerability class: 2022 was a bridge contract wrap/unwrap flaw and 2026 is reportedly a mainnet block validation flaw.
confirmed
7 claimsThe cited evidence supports the claim as written.
- #5[confirmed][no action needed]in section: Incident Overview
“The attacker used that flaw to mint approximately $2.3 million in unbacked wMTRG tokens across roughly two transactions, and sold part of the proceeds on PancakeSwap.”
reviewerAbout $2.3M unbacked wMTRG minted in roughly two transactions, partly sold on PancakeSwap, exploit still active at the initial alertThe $2.3M figure is a Blockaid estimate, and the sources describe it as 'so far'. - #6[confirmed][no action needed]in section: Incident Overview
“Two attacker addresses were publicly disclosed by the Meter team: 0xee2eeeed4ed8580669ed924abeb49f27f7d0bd65 and 0x44cf94496091150865e192a86c07b90a9760b43d.”
reviewerTwo attacker addresses were publicly disclosed by the Meter teamMatches CoinGabbar. I did not check the addresses on-chain, and no first-party Meter post was fetched. - #9[confirmed][no action needed]in section: Technical Mechanism
“transactions after block number 100731417 on the Meter mainnet may not be considered valid during that process”
reviewerTransactions after block 100731417 may not be honoredConfirmed by two outlets. - #10[confirmed][no action needed]in section: Market and Price Impact
“the MTRG token fell approximately 71.7% in a single day, dropping from $0.00991494 to $0.002682, with token market capitalization reported at approximately $391,067 at the lows”
reviewerMTRG fell ~71.7% from $0.00991494 to $0.002682, market cap ~$391,067The page's wording that this was at 'the lows' is a mild gloss. - #12[confirmed][no action needed]in section: Meter Team Response and Recovery
“Meter offered the attacker a 10% reward for returning stolen funds within 72 hours”
reviewerMeter offered a 10% reward for return within 72 hoursCryptoNews.net also says Meter will pursue legal options after the deadline. - #13[confirmed][no action needed]in section: Meter Team Response and Recovery
“The team confirmed that chain state was preserved”
reviewerChain state was preserved; users warned of fake recovery sites; working with exchanges, security firms and law enforcementSupported by CoinGabbar. CryptoNews.net does not mention the fake sites. - #15[confirmed][no action needed]in section: Pattern of Repeat Vulnerability: February 2022 Precedent
“In February 2022, Meter's Passport bridge suffered a $4.4 million exploit caused by a "wrong trust assumption" in the bridge's smart contract code.”
reviewerFebruary 2022 exploit details: $4.4M, wrong trust assumption, 77% BNB crash on Moonriver, SushiSwap sales, Hundred Finance ~$3.3M bad debt, $4.4M MTRG set asideMatches the timeline entry dated 2022-02-05.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.