MAP Protocol’s native token, MAPO, suffered a catastrophic 96% drop after a vulnerability in the Butter Network cross-chain bridge allowed an attacker to mint an astronomically large number of tokens. The exploit, which took place on the Ethereum and BNB Chain networks, resulted in the creation of approximately one quadrillion MAPO tokens—vastly exceeding the legitimate supply of around 208 million.
Blockchain security firm Blockaid reported that the attacker manipulated a Solidity contract flaw to produce these tokens and then quickly dumped about 1 billion of them on Uniswap liquidity pools. This selling pressure caused MAPO’s price to plummet from roughly $0.003 to nearly $0.0001 in a matter of hours. The attacker managed to drain approximately 52 ETH (worth around $180,000) from the pools but still holds close to a trillion MAPO tokens, posing a persistent threat to other liquidity pools and exchange markets.
The root cause of the exploit was traced to a collision in the abi.encodePacked function used to validate cross-chain retry messages. Blockaid explained that the bridge’s verification process lacked proper length prefixes for dynamic-byte fields, allowing the attacker to repackage a legitimate signed message into a forged retry request. The protocol accepted this altered payload, leading to the unauthorized mint. Notably, the project confirmed that the light client, oracle multisig, and MAPO token contract itself were not compromised.
In response, Map Protocol paused its mainnet and initiated a migration process. The team announced plans to release a new contract address and an asset snapshot timeline, while tokens associated with the attacker’s wallets will be excluded from future conversions and invalidated during migration. These measures aim to restore integrity to the token supply.
This incident adds to a growing list of cross-chain bridge exploits within the DeFi sector. Earlier in the week, the Verus Protocol Ethereum bridge lost over $11.5 million in a similar forged-transfer attack. Meanwhile, the TON-TAC bridge successfully recovered about 80% of the $2.68 million stolen in a May 11 exploit, though the bridge remains suspended pending an independent audit. The repeated vulnerabilities underscore the persistent risks in interoperability infrastructure, highlighting the need for more robust validation mechanisms.