Verify a decision

{"actor":"system:backfill","investigation_id":"e98a95f3-54ca-4a7f-97c8-306ea11a5c08","kind":"publish","page_slug":"meter-bridge","published_at":"2026-05-31T06:59:48.026Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Meter Passport Bridge","sections":[{"content":"On February 5, 2022, beginning at approximately 2:30 PM UTC, an attacker exploited a logic flaw in Meter Passport's ERC20 Handler contract and drained 3,632.8 BNB from the BSC handler and 422.5 ETH from the Ethereum handler. The attacker also minted 30,000 BNB.bsc and 1,500 WETH.eth on Moonriver and Meter networks respectively without depositing corresponding collateral. PeckShield estimated the total direct theft at approximately $4.4 million. The bridge was paused at approximately 4:00 PM UTC, roughly 90 minutes after the attack began. Stolen funds were subsequently routed through Tornado Cash on Ethereum, making direct on-chain recovery impractical. The exploit occurred just days after the Wormhole bridge hack ($302 million, January 2022) and the Qubit Finance bridge hack ($80 million, January 2022), marking it as the third major bridge exploit in less than two weeks.","heading":"February 2022 Exploit: Overview","severity":"critical","sources":[{"credibility":1,"name":"Post Mortem Report — Meter Passport (Official, Meter.io Medium)","type":"official","url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"credibility":2,"name":"CoinTelegraph: Latest DeFi bridge exploit results in $4.4M losses for Meter","type":"news_article","url":"https://cointelegraph.com/news/latest-defi-bridge-exploit-results-in-4-4m-losses-for-meter"},{"credibility":2,"name":"BeinCrypto: Cross-chain Bridge Hack of Meter Sees $4.4M Stolen","type":"news_article","url":"https://beincrypto.com/cross-chain-bridge-hack-of-meter-sees-4-4m-stolen/"}]},{"content":"Meter Passport was built on a fork of ChainBridge, open-source bridge software maintained by ChainSafe. Meter's development team added functionality to automatically wrap and unwrap native gas tokens (ETH on Ethereum, BNB on Binance Smart Chain) into ERC20-compatible equivalents for bridging. To support this, a separate depositEth() function was created that validated that msg.value matched the calldata amount. However, the underlying ERC20 deposit() function retained a condition that assumed: if the token being bridged is a wrapped native token, it does not need to be burned or locked, because the native token is presumed to have already been transferred to the handler. This assumption was never enforced by a validation check in the deposit() function. An attacker could call deposit() directly with a wrapped native token (WETH or BNB), pass an arbitrary large amount in the calldata, and the handler would process the withdrawal without verifying any corresponding inbound transfer. The contract effectively minted bridged tokens for free. ChainSafe published a technical breakdown confirming this root cause.","heading":"Technical Vulnerability: Wrapped Native Token Trust Assumption","severity":"critical","sources":[{"credibility":1,"name":"ChainSafe: Breaking Down the Meter Hack","type":"research","url":"https://blog.chainsafe.io/breaking-down-the-meter-hack/"},{"credibility":2,"name":"Halborn: Explained — The Meter.io Hack (February 2022)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-meter-io-hack-february-2022"},{"credibility":1,"name":"Post Mortem Report — Meter Passport (Official, Meter.io Medium)","type":"official","url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"}]},{"content":"After draining Meter Passport's BNB reserves, the attacker sold the stolen BNB on SushiSwap on the Moonriver network, causing the on-chain price of BNB on Moonriver to crash approximately 77%. Opportunistic actors purchased the artificially cheap BNB and deposited it as collateral on Hundred Finance, a lending protocol also deployed on Moonriver. Because Hundred Finance continued to use an inflated oracle price for BNB.bsc as collateral, these actors were able to borrow FRAX, ETH, and MIM in amounts exceeding the real value of their collateral. Hundred Finance's post-mortem report acknowledged the protocol did not disable BNB.bsc as collateral promptly after the Meter attack was announced. Two of the undercollateralized loans were ultimately repaid by the borrowers; however, approximately $2.135 million in FRAX loans remained unrecovered. Combined with the direct $4.4 million bridge loss, total ecosystem damage reached approximately $6.5 million. The Meter team committed to compensating Hundred Finance as part of its broader restitution plan.","heading":"Cascading Impact: Hundred Finance and Moonriver BNB Price Crash","severity":"high","sources":[{"credibility":2,"name":"Hundred Finance Forum: Moonriver Deployment Exploit Post Mortem Report","type":"official","url":"https://forum.hundred.finance/t/hundred-finance-moonriver-deployment-exploit-post-mortem-report/35"},{"credibility":2,"name":"CoinTelegraph: Latest DeFi bridge exploit results in $4.4M losses for Meter","type":"news_article","url":"https://cointelegraph.com/news/latest-defi-bridge-exploit-results-in-4-4m-losses-for-meter"},{"credibility":2,"name":"Halborn: Explained — The Meter.io Hack (February 2022)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-meter-io-hack-february-2022"}]},{"content":"On February 6, 2022, the Meter team announced it had set aside $4.4 million in MTRG (Meter Governance tokens) to cover initial losses. Following a community governance vote, the compensation mechanism was modified: the Meter team issued PASS tokens on the Meter mainnet, with each PASS token redeemable for $1 USD in compensation. The MTRG price basis was set at $2.62 per MTRG as of February 5, 2022. Compensation was distributed across four categories of affected holders: ETH holders (1,264,614.68 PASS), BNB holders (1,453,301.64 PASS), Moonriver BNB.bsc holders (1,014,062.28 PASS), and Meter WETH.eth holders (517,025.44 PASS). Hundred Finance received 20,266.92 BNB.bsc compensation. PASS tokens were distributed beginning April 3, 2022. The Meter team stated it was working with white-hat security researchers, security consultants, and law enforcement specializing in cryptocurrency cybercrime, though no arrest or fund recovery was publicly announced.","heading":"Compensation Plan and Community Response","severity":"medium","sources":[{"credibility":1,"name":"Post Mortem Report — Meter Passport (Official, Meter.io Medium)","type":"official","url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"credibility":2,"name":"BankInfoSecurity: $4.4 Million Stolen From Crypto Firm: Multi-Bridge Exploited","type":"news_article","url":"https://www.bankinfosecurity.com/44-million-stolen-from-crypto-firm-multi-bridge-exploited-a-18467"}]},{"content":"Following the February 2022 exploit, the Meter team committed to rebuilding Meter Passport on ChainSafe's v2.x bridge contracts, releasing the upgrade as Meter Passport v1.5. The updated smart contracts were audited by HAECHI AUDIT. The HAECHI audit identified 8 findings of varying severity — three critical, two major, and three minor — all of which were reported as resolved prior to deployment. The original vulnerable contracts had been internally reviewed through a separate team at ChainSafe, but that review failed to surface the deposit() validation flaw. The Meter team also announced plans to establish an official bug bounty program. The Meter Docs site now publishes a dedicated security audit page listing the HAECHI report for Passport v1.5.","heading":"Security Remediation: Passport v1.5 and HAECHI Audit","severity":"medium","sources":[{"credibility":1,"name":"Meter Docs: Security Audit for Meter Passport","type":"official","url":"https://docs.meter.io/passport/security-audit-for-meter-passport"},{"credibility":1,"name":"Meter Medium: Meter Passport v1.5 completes a rigorous Audit by HAECHI","type":"official","url":"https://medium.com/meter-io/meter-passport-v1-5-completes-a-rigorous-audit-by-haechi-760cbda5959"},{"credibility":1,"name":"ChainSafe: Breaking Down the Meter Hack","type":"research","url":"https://blog.chainsafe.io/breaking-down-the-meter-hack/"}]},{"content":"The Meter Passport exploit occurred within a concentrated period of cross-chain bridge attacks in early 2022. Qubit Finance lost $80 million in late January 2022, and Wormhole lost $302 million on February 2, 2022 — three days before the Meter Passport attack. Security researchers at Protos and Halborn have noted that cross-chain bridges are systematically high-value targets because they hold large pools of locked assets and frequently involve complex multi-chain contract interactions that create non-obvious attack surfaces. The Meter vulnerability specifically mirrored the logic flaw pattern seen in the earlier Qubit Finance hack, where deposit functions with inconsistent validation between native and ERC20 token paths created exploitable bypass conditions.","heading":"Broader Bridge Security Context","severity":"medium","sources":[{"credibility":2,"name":"Protos: Explained — Why hackers keep exploiting cross-blockchain bridges","type":"news_article","url":"https://protos.com/explained-why-hackers-keep-exploiting-cross-blockchain-bridges/"},{"credibility":2,"name":"Crowdfund Insider: DeFi Hack Analysis — $4M+ Lost Via Meter's Passport Bridge Exploit","type":"news_article","url":"https://www.crowdfundinsider.com/2022/02/186752-defi-hack-analysis-4m-lost-via-meters-passport-bridge-exploit-days-after-wormhole-portal-breach/"}]},{"content":"Stolen funds were confirmed by PeckShield and CoinTelegraph to have been routed through Tornado Cash on Ethereum following the theft. No public announcement of fund recovery or attacker identification was made by the Meter team or law enforcement as of the information available through 2022. The Meter team's post-mortem stated it was collaborating with cybercrime-specialized law enforcement and cryptocurrency security consultants, but provided no further public updates on the investigation outcome. The use of Tornado Cash, a cryptocurrency mixing service, is consistent with other major DeFi exploits from the same period and significantly reduces the probability of on-chain fund tracing.","heading":"Fund Recovery and Law Enforcement","severity":"high","sources":[{"credibility":1,"name":"Post Mortem Report — Meter Passport (Official, Meter.io Medium)","type":"official","url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"credibility":2,"name":"Web3 Is Going Great: Meter Passport exploited for $4.3 million","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=2022-02-05-0"}]}],"sources_used":[{"name":"Post Mortem Report — Meter Passport (Official, Meter.io Medium)","type":"official","url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"name":"ChainSafe: Breaking Down the Meter Hack","type":"research","url":"https://blog.chainsafe.io/breaking-down-the-meter-hack/"},{"name":"Halborn: Explained — The Meter.io Hack (February 2022)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-meter-io-hack-february-2022"},{"name":"CoinTelegraph: Latest DeFi bridge exploit results in $4.4M losses for Meter","type":"news_article","url":"https://cointelegraph.com/news/latest-defi-bridge-exploit-results-in-4-4m-losses-for-meter"},{"name":"BeinCrypto: Cross-chain Bridge Hack of Meter Sees $4.4M Stolen","type":"news_article","url":"https://beincrypto.com/cross-chain-bridge-hack-of-meter-sees-4-4m-stolen/"},{"name":"Crowdfund Insider: DeFi Hack Analysis — $4M+ Lost Via Meter's Passport Bridge Exploit","type":"news_article","url":"https://www.crowdfundinsider.com/2022/02/186752-defi-hack-analysis-4m-lost-via-meters-passport-bridge-exploit-days-after-wormhole-portal-breach/"},{"name":"BankInfoSecurity: $4.4 Million Stolen From Crypto Firm: Multi-Bridge Exploited","type":"news_article","url":"https://www.bankinfosecurity.com/44-million-stolen-from-crypto-firm-multi-bridge-exploited-a-18467"},{"name":"Web3 Is Going Great: Meter Passport exploited for $4.3 million","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=2022-02-05-0"},{"name":"Hundred Finance Forum: Moonriver Deployment Exploit Post Mortem Report","type":"official","url":"https://forum.hundred.finance/t/hundred-finance-moonriver-deployment-exploit-post-mortem-report/35"},{"name":"Meter Docs: Security Audit for Meter Passport","type":"official","url":"https://docs.meter.io/passport/security-audit-for-meter-passport"},{"name":"Meter Medium: Meter Passport v1.5 completes a rigorous Audit by HAECHI","type":"official","url":"https://medium.com/meter-io/meter-passport-v1-5-completes-a-rigorous-audit-by-haechi-760cbda5959"},{"name":"Protos: Explained — Why hackers keep exploiting cross-blockchain bridges","type":"news_article","url":"https://protos.com/explained-why-hackers-keep-exploiting-cross-blockchain-bridges/"}],"summary":"Meter Passport is the cross-chain bridge product of Meter Protocol, a layer-1 blockchain infrastructure project. On February 5, 2022, the bridge was exploited for approximately $4.4 million due to a flawed trust assumption in the ERC20 handler contract's treatment of wrapped native tokens (WETH and BNB). Cascading effects from the exploit caused an additional ~$2.1 million in losses to the Hundred Finance protocol on Moonriver, bringing total ecosystem damage to roughly $6.5 million.","timeline":[{"date":"2022-01-28","event":"Qubit Finance bridge exploited for $80 million, using a similar deposit function validation flaw pattern.","source":"Crowdfund Insider","source_url":"https://www.crowdfundinsider.com/2022/02/186752-defi-hack-analysis-4m-lost-via-meters-passport-bridge-exploit-days-after-wormhole-portal-breach/"},{"date":"2022-02-02","event":"Wormhole bridge exploited for $302 million, the largest bridge hack to date at the time.","source":"Crowdfund Insider","source_url":"https://www.crowdfundinsider.com/2022/02/186752-defi-hack-analysis-4m-lost-via-meters-passport-bridge-exploit-days-after-wormhole-portal-breach/"},{"date":"2022-02-05","event":"Meter Passport bridge exploit begins at approximately 2:30 PM UTC. Attacker calls deposit() directly on ERC20 Handler contracts with wrapped native tokens, bypassing collateral checks.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-02-05","event":"Attacker drains 3,632.8 BNB from BSC ERC20 handler and 422.5 ETH from Ethereum handler. Mints 30,000 BNB.bsc on Moonriver and 1,500 WETH.eth on Meter network.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-02-05","event":"Meter team pauses bridge operations at approximately 4:00 PM UTC, roughly 90 minutes after the attack begins.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-02-05","event":"Vulnerability in ERC20 Handler identified at approximately 4:30 PM UTC. Loss figures calculated and released by 7:30 PM UTC.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-02-05","event":"Attacker sells stolen BNB on SushiSwap on Moonriver, causing BNB price on Moonriver to crash approximately 77%. Opportunists buy cheap BNB and borrow against it on Hundred Finance.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/latest-defi-bridge-exploit-results-in-4-4m-losses-for-meter"},{"date":"2022-02-06","event":"Meter team publicly commits to reimbursing community and Hundred Finance, setting aside $4.4 million in MTRG tokens to cover initial losses.","source":"BeinCrypto","source_url":"https://beincrypto.com/cross-chain-bridge-hack-of-meter-sees-4-4m-stolen/"},{"date":"2022-02-06","event":"Moonriver network notified at approximately 8:30 PM UTC (Feb 5) of the cascading secondary impact.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-03-10","event":"Deadline for affected users to submit tokens for the PASS compensation airdrop.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-03-12","event":"Governance proposal for PASS token compensation structure passes community vote.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-03-15","event":"PASS token airdrop begins for affected Meter Passport users.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-04-03","event":"PASS tokens fully distributed to all eligible affected users. Total compensation: approximately $4.25 million USD denominated in PASS tokens.","source":"Meter.io Post Mortem (Official)","source_url":"https://medium.com/meter-io/post-mortem-report-meter-passport-12af6b50393d"},{"date":"2022-04","event":"Meter Passport v1.5 upgrade announced, based on ChainSafe v2.x bridge contracts. HAECHI AUDIT engaged for security review.","source":"Meter Docs","source_url":"https://docs.meter.io/passport/security-audit-for-meter-passport"},{"date":"2022","event":"HAECHI AUDIT completes audit of Meter Passport v1.5, identifying and resolving 8 findings (3 critical, 2 major, 3 minor) before deployment.","source":"Meter Medium: v1.5 HAECHI Audit","source_url":"https://medium.com/meter-io/meter-passport-v1-5-completes-a-rigorous-audit-by-haechi-760cbda5959"}]},"v":1}