MAPProtocol exploit analysis
MAPProtocol's bridge fee was recorded at the moment of the next call, so multiple micro-deposits inflated the recorded fee and the reward was harvested against it. DeFiHackLabs reconstructs about $180K drained.
- Reported loss
- ~$180K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-20: Arbitrary Mint on MAPProtocol”.
Analysis1 min read
MAPProtocol's bridge reward paid the caller's recorded fee in MAP but checked the caller's MAP balance only at the moment of the next bridge call. The attacker bridged multiple micro-deposits to inflate the recorded fee, harvested the reward, then bridged back.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0x31e56b4737649e0acdb0ebb4eca44d16aeca25f60c022cbde85f092bde27664a on Etherscan for a total loss of about $180K.
What would have prevented it: a per-bridge-call fee recorded against the actual cross-chain settlement, with the reward debited from the same balance.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260520-mapprotocol---bridge-fee-recorded-against-next-call-balance
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/MAPProtocol_exp.sol
- https://etherscan.io/tx/0x31e56b4737649e0acdb0ebb4eca44d16aeca25f60c022cbde85f092bde27664a
Other exploits
- WUSD.fi exploit analysis 25 May 2026
- FractalProtocol exploit analysis 22 May 2026
- MureDistribution exploit analysis 21 May 2026
- ElevateFi exploit analysis 19 May 2026
- TesseraSwap exploit analysis 18 May 2026
- SEAToken exploit analysis 17 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
