Meter exploit analysis

What happened

On 23 September 2026 at 21:14 UTC, an attacker exploited a flaw in the cross-chain bridge that Meter.io uses to move its MTR and MTRG tokens between chains. The bridge accepted mint instructions it should have rejected, and the attacker walked away with wrapped MTR and wrapped MTRG on BNB Chain that had no collateral behind them. The notional value of the unbacked tokens was reported at around $2.3 million, created across roughly two mint transactions (Web3 Is Going Great, Blockaid).

The attacker sold part of the haul on PancakeSwap and bridged the rest out. Both tokens collapsed: MTRG, the governance token, fell by between 71% and 88% depending on the source, and MTR, which is meant to track the cost of producing 10 kWh of electricity, fell by a similar amount. Once a stable-pegged asset has unbacked supply injected into it, the peg does not survive, and the trade hammered MTR's quoted price down with MTRG's.

The mechanism

Meter attributed the root cause to a "block validation flaw" on its mainnet, and stopped short of a full technical post-mortem at the time of writing. Blockaid, the security firm that first flagged the attack, identified the affected contract as the wrapped MTRG deployment on BNB Chain at 0xbd2949f67dcdc549c6ebe98696449fa79d988a9f and two attacker addresses (0xEe2EEEED4Ed8580669ED924abEb49f27f7D0Bd65 and 0x7db6ac6Fa3c8aa2c6FB9BdCD4800e8BAacDd2EE8). One of those addresses held tokens worth approximately $1.18 million across 23 transactions at the time of reporting, with no BNB balance (Crypto Times, Protos).

The economic picture is the part the press undersells. A mint-only attack, where the attacker prints tokens that did not exist and sells them on a DEX, is bounded by the depth of the on-chain liquidity the attacker can dump into. PancakeSwap liquidity for the MTRG/MTR pairs was thin. The block-validation wording from the project implies the bridge's verification step was the failure rather than a key compromise, which puts the bug in the same broad class as the largest cross-chain bridge losses of the past three years: a destination-side check that should have rejected the mint, and did not.

The response

Meter paused both its mainnet and the Meter Passport bridge within hours. Its security notice warned that "Transactions after block 100731417 may not be honored", language that points toward a planned chain rollback to unwind the exploit rather than a patch-and-resume (Web3 Is Going Great). The team said it was working with centralised exchanges to suspend MTR and MTRG deposits and withdrawals, and that it had contacted law enforcement and security partners to trace and freeze the proceeds. Crypto-economy reported that Meter also made an offer to the attacker, a common step in this kind of incident when recovery looks more likely than prosecution (Crypto Economy).

The chain state has been preserved, in the project's words. The question of how to restore balances was still open at the time of writing.

History

This is Meter's second bridge-related incident. In February 2022, attackers exploited a vulnerability in the ERC-20 handler used to process Passport deposits and withdrawals, and Meter reported losses of approximately $4.25 million across Ethereum, BNB Chain, Moonriver, and its own chain (Crypto Times). Meter has not said whether the 2026 exploit involves the same vulnerability as the 2022 one, but both sit in the bridge's mint/deposit path, and the project has not yet published a full technical write-up of the new one.

A day, not a pattern

The Meter exploit was the third in a single day that the press covered together. On 24 September 2026, Payy Network lost around $1.8 million to a bridge drain and Duelbits, a crypto casino, took a $7 million hit and went offline, with the three losses reportedly totalling more than $11 million (Protos, Crypto Economy). They shared a day and a common element of the day's press cycle, but the three incidents were otherwise unrelated in mechanism, target and chain.