The WAXP network's multichain bridge is believed to be under active attack after an exploiter abused a flaw in WAX's smart-contract withdrawal-fee validation, blockchain security firm Blockaid said. The weakness allowed negative withdrawal-fee values, enabling the attacker to create withdrawal requests without providing the corresponding assets. The bridge then paid out tokens on Solana and Ethereum based on those requests. Blockaid said five transactions had drained about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC. The firm said the code had not been fixed, leaving the bridge exposed to further attacks; the total impact remains under review.