Blockchain platform Meter is under an ongoing attack on BNB Chain, in which an attacker is exploiting a vulnerability in Meter Passport to mint unbacked wrapped MTRG tokens. According to monitoring platform Blockaid, the attacker has already created approximately $2.3 million in unbacked wrapped MTRG through around two minting transactions and has begun selling some of the tokens on decentralized exchange PancakeSwap. The attack is ongoing, and the scale of the losses could increase.
Key incident facts: Meter Passport is under an ongoing attack on BNB Chain; the attacker is exploiting a vulnerability to mint unbacked wrapped MTRG; ~$2.3 million in unbacked tokens has been created through ~2 minting transactions; some of the tokens are being sold on PancakeSwap; the attack is continuing in real time.
Meter Passport is a cross-chain bridge that allows users to move assets between different blockchains through a wrapping and unwrapping process. Under normal operation, when a user wants to move MTRG tokens from the Meter network to BNB Chain, they lock the original MTRG on the Meter network, and Meter Passport mints an equivalent amount of wrapped MTRG (wMTRG) on BNB Chain. These wrapped tokens are backed by the locked original tokens at a 1:1 ratio.
The current attack exploits a critical vulnerability in this mechanism: the attacker is able to mint wrapped MTRG on BNB Chain without a corresponding lock of original MTRG on the Meter network. This creates unbacked tokens that have no real assets behind them but can be sold on decentralized exchanges as legitimate assets. According to Blockaid, the attacker executed approximately two minting transactions, creating around $2.3 million worth of wrapped MTRG in total.
After minting the unbacked tokens, the attacker began selling some of them on PancakeSwap, the largest decentralized exchange in the BNB Chain ecosystem. These sales create artificial supply in the market and allow the attacker to convert unbacked tokens into other cryptocurrencies, effectively draining liquidity from PancakeSwap pools. Each sale dilutes the value of legitimate wrapped MTRG tokens and creates losses for ordinary users who purchase these tokens without knowing that they are unbacked.
Meter Passport is a critical component of the Meter ecosystem, providing interoperability between different blockchains. The bridge allows users to move assets between the Meter network and other popular blockchains, including Ethereum, BNB Chain and others. The bridge architecture is based on a system of validators that verify transactions and authorize the minting of wrapped tokens on destination networks.
Meter's history already includes security incidents. In 2022, the platform suffered a major attack that resulted in the theft of more than $4 million. That attack also exploited vulnerabilities in bridge mechanisms, allowing the attacker to manipulate prices and withdraw funds. The current incident demonstrates that security problems in cross-chain bridges remain unresolved and that attackers continue to find new ways to exploit these systems.
Cross-chain bridges represent one of the most vulnerable categories of DeFi protocols. Statistics show that bridges account for a significant share of all losses from DeFi hacks. This is due to their complex architecture, the need to coordinate between different blockchains and the concentration of large amounts of funds at centralized points of control. Meter Passport, like other bridges, faces the challenge of maintaining security while preserving functionality and transaction speed.
| Bridge Component | Function | Risk |
|---|---|---|
| Validators | Transaction verification and minting authorization | Compromise enables unbacked minting |
| Smart Contracts | Wrapping/unwrapping logic | Code vulnerabilities enable manipulation |
| Price Oracles | Determining asset values | Price manipulation leads to losses |
| Liquidity | Facilitating swaps | Concentration of funds attracts attackers |
The current Meter Passport attack highlights the importance of multi-layered protection for cross-chain bridges. Simple balance checks or basic authorization mechanisms are insufficient to protect against sophisticated attacks. Bridges should implement additional layers of verification, including multi-signature requirements, time-locks for large transactions, continuous monitoring for anomalous activity and automated pause mechanisms when suspicious patterns are detected.
Historical context: Meter was previously attacked in 2022, with losses exceeding $4 million. The current incident shows that vulnerabilities in cross-chain bridges remain a critical security problem within the DeFi ecosystem.
Monitoring platform Blockaid was the first to detect and publicly report the attack, providing critical information to the community. Blockaid specializes in tracking suspicious activity across blockchain networks and warning users about potential threats. Early detection of such attacks is critical for minimizing damage because it allows users and protocols to respond quickly to incidents.
PancakeSwap, as the venue where the attacker is selling the unbacked tokens, also plays an important role in the security ecosystem. Decentralized exchanges can implement mechanisms to identify and block suspicious tokens, although this creates a trade-off between decentralization and security. Users should exercise caution when trading wrapped tokens, particularly during known attacks against the corresponding bridges.
For users holding wrapped MTRG or planning to trade these tokens, the current situation requires heightened caution. Unbacked tokens created by the attacker are indistinguishable from legitimate wrapped MTRG at the blockchain level, making it practically impossible for ordinary users to determine which tokens are backed and which are not. The only reliable indicator is the total circulating supply: if the amount of wrapped MTRG on BNB Chain exceeds the amount of MTRG locked on the Meter network, this indicates the presence of unbacked tokens.
The Meter Passport attack adds another case to the growing list of cross-chain bridge security incidents, highlighting systemic problems within this category of DeFi protocols. Over the past several years, bridges have become one of the most heavily targeted categories, with losses totaling hundreds of millions of dollars. These incidents reveal fundamental challenges in designing secure interoperable systems.
One of the key problems is the trade-off between decentralization and security. Fully decentralized bridges with minimal validation requirements are more vulnerable to attacks, while centralized bridges create a single point of failure. The industry is seeking a balance through hybrid approaches involving multi-signature schemes, decentralized validator networks and additional verification layers without excessive centralization.
For bridge developers, the current incident highlights the need to implement comprehensive security measures. These include regular security audits by independent firms, bug bounty programs to attract white-hat hackers, formal verification of critical code components, real-time monitoring systems for anomaly detection and clearly defined incident response plans. In addition, bridges should implement circuit breakers — mechanisms that automatically pause operations when suspicious activity is detected.
| Security Measure | Description | Effectiveness |
|---|---|---|
| Multi-signature | Requires multiple signatures for transactions | High against single-point compromise |
| Time-locks | Delays execution of large transactions | Provides time for detection and response |
| Circuit breakers | Automatic suspension when anomalies are detected | Prevents attacks from escalating |
| Continuous monitoring | Real-time activity monitoring | Early incident detection |
| Formal verification | Mathematical proof of code correctness | Eliminates entire classes of vulnerabilities |
For users and investors, the Meter Passport incident serves as a reminder of the importance of due diligence when using DeFi protocols, particularly cross-chain bridges. Before using any bridge, users should research its security history, audit results, protection mechanisms and reputation within the community. Diversifying across multiple bridges instead of concentrating all funds in a single one can also reduce risk.
The future of cross-chain interoperability depends on the industry's ability to learn from these incidents and implement more robust solutions. Standardization of security practices, threat intelligence sharing between protocols and collaborative defense initiatives can significantly improve the overall security of the ecosystem. Every incident, however painful, provides valuable data for improving defensive mechanisms and moves the industry closer to safer and more reliable interoperable infrastructure.
Key lesson: Cross-chain bridges remain one of the most vulnerable categories of DeFi protocols. Users should conduct thorough due diligence, while developers should implement multi-layered defenses including multi-signature controls, time-locks, circuit breakers and continuous monitoring.
The current Meter Passport attack is not yet over, and the final scale of the losses will become known later. However, it is already clear that the incident highlights the critical importance of security in cross-chain infrastructure. The Meter team's ability to respond quickly to the attack, communicate transparently with the community and implement the necessary fixes will determine whether the protocol can restore user trust and continue developing. For the broader DeFi ecosystem, this case serves as another reminder that security is not a one-time event but a continuous process requiring constant vigilance and improvement.
“Security in decentralized systems is not a destination, but a journey. Every attack reveals new vulnerabilities, but also provides opportunities to build more robust and resilient infrastructure.”
— Andreas Antonopoulos, blockchain technology and security expert
