1 Quadrillion MAPO Minted in Butter Bridge Exploit
On May 20 an attacker minted 1,000,000,000,000,000 MAPO via a spoofed Butter Bridge message, swapped some for ~52.2 ETH and removed over $180,000 as price fell ~30%.
An attacker minted 1,000,000,000,000,000 MAPO on May 20, 2026 by sending a spoofed cross-chain message through the Butter Bridge and routing the tokens to wallet 0x40592025392BD7d7463711c6E82Ed34241B64279. On-chain records show portions of the inflated supply were swapped for about 52.2 ETH (roughly $110,000) and more than $180,000 was removed from Uniswap liquidity pools. Most of the minted tokens remain in the attacker’s wallet.
Security firm PeckShield flagged a vulnerability in Butter Bridge V3.1’s OmniServiceProxy contract that allowed an unauthorized mint from the zero address on both Ethereum and Binance Smart Chain. On-chain analysis shows the attacker used the spoofed cross-chain message to bypass validation and create the inflated balance, then executed swaps and liquidity removals from a single address.
The minted amount is roughly 4.8 million times the legitimate circulating supply of about 208 million MAPO. The token traded around $0.003 before the exploit and fell to about $0.001558 after the mint and liquidity withdrawals, a decline of nearly 30 percent. Liquidity providers and traders in MAPO pairs experienced immediate losses as prices and available liquidity changed rapidly.
MAP Protocol describes itself as a Bitcoin Layer-2 and omnichain interoperability project that uses light clients and multi-party computation verification to move BTC, stablecoins and tokenized assets across chains. On-chain analysis and the security advisory indicate the exploit targeted cross-chain message validation rather than the project’s light client or MPC components.
MAP Protocol had not issued a formal statement outlining mitigation steps such as pausing bridge contracts, blacklisting affected tokens, or adjusting supply at the time PeckShield raised the alert. The project’s public channels showed no immediate update when on-chain monitors published their findings.
PeckShield and other on-chain monitors raised alarms within minutes of the transactions and traced the flow of tokens and liquidity removals. PeckShield noted the incident follows multiple cross-chain exploits in 2026 that together have drained large sums from decentralized finance platforms. On-chain investigators continue to monitor the attacker’s address and related transactions for further movement or liquidation of the remaining inflated MAPO.
Articles by this author
