Highlights
- Meter Passport, the project's cross-chain bridge on BNB Chain, was exploited to mint unbacked wrapped MTRG (wMTRG).
- Blockaid's monitoring put the unauthorized minting at roughly $2.3 million across about two transactions.
- PeckShield separately reported that more than 1 billion MTRG had been minted, with the token's price crashing over 74% within hours.
- The attacker began selling the illicit tokens on PancakeSwap while the exploit remained active.
Meter's governance token MTRG lost more than three-quarters of its value on September 24 after an attacker found a way to mint tokens out of thin air. Security firm Blockaid said the exploit targeted Meter Passport, the protocol's bridge for moving assets between BNB Chain and other networks, and that the intrusion was still unfolding as monitoring continued through the afternoon.
PeckShield's own alert, published around the same time, put a number on the damage that hit home for anyone watching the chart: more than 1 billion MTRG minted out of nowhere, with the token down over 74% within minutes of the alert going out. Blockaid's separate tally, filtered down to the actual unbacked value created, came in at approximately $2.3 million across roughly two minting transactions, a gap between the raw token count and dollar value that reflects just how far MTRG's price had already fallen by the time both firms were counting.
The mechanism itself is a familiar one in cross-chain security circles. Meter Passport works as a message-passing bridge: a listener contract watches for events on a source chain, a router forwards that message, and a writer contract executes the corresponding transaction on the destination chain. wMTRG is supposed to only exist on BNB Chain in amounts backed one-to-one by MTRG locked on Meter's own network. When an attacker can trick the writer into minting wMTRG without a matching lock event, the wrapped supply becomes worthless paper backed by nothing, and that is exactly what Blockaid says happened here.
The attacker didn't sit on the minted tokens. Both Blockaid and PeckShield's monitoring showed wMTRG being routed straight into PancakeSwap and sold, a pattern that mirrors a separate incident earlier this year where the same attacker drained two DeFi protocols for a combined $2 million using a comparable mint-and-dump approach. Selling into an automated market maker rather than a centralized exchange lets an attacker cash out within seconds of a successful exploit, before liquidity providers or the protocol team have a realistic chance to pause trading.
Related: Fetch.ai and NuNet Hit by Same Attacker in $2M AI-Token Exploit
As of the most recent monitoring cited by Blockaid, the attack was still ongoing, meaning the final tally of unbacked tokens minted could climb further before Meter's team manages to patch whatever allowed the writer contract to be fooled. Neither Meter nor its official channels had published a statement addressing the exploit at the time PeckShield and Blockaid's alerts went out, leaving holders to piece together the scale of the damage from third-party security monitoring rather than an official incident report.
Bridge exploits remain one of the more persistent categories of loss in DeFi precisely because a bridge has to be trusted by two chains at once, doubling the attack surface compared with a contract that lives entirely on one network. Incidents like the phishing campaign that Japanese, American and German authorities jointly attributed to North Korea's WaterPlum group and infrastructure shifts like Saudi Arabia's exit from the China-led mBridge payment system both underline how much scrutiny cross-chain plumbing is drawing right now, from both attackers and regulators, as more value moves across bridges rather than staying native to a single chain.
For MTRG holders, the immediate concern is straightforward: a token that traded normally before September 24 is now down more than three-quarters in value, and the unbacked wMTRG still circulating on BNB Chain represents a liability that will need to be addressed, whether through a burn, a snapshot-based reissuance, or some other remediation, before confidence in the wrapped asset can realistically recover.
