OPUL Bridge Exploit

Forensic Report · Last updated 31 March 2026

Executive Summary

On March 13 and 14, 2026, an attacker exploited a vulnerability in the Messina cross-chain bridge to steal approximately 475 million OPUL tokens from bridge escrow vaults across three blockchains: Arbitrum, Ethereum, and BSC.

The vulnerability was a token multiplication flaw in the bridge's hop() function. By repeatedly calling this function, the attacker was able to generate new legitimate transfer approvals from a single original deposit, multiplying the claimable amount up to 143 times. The bridge's Guardian network, which is designed to sign all valid on-chain events without evaluating business logic, signed each of these approvals as legitimate.

The stolen tokens were rapidly sold on decentralized exchanges for ETH, USDC, and USDT. Our forensic investigation has traced the full flow of funds, identified 28 confirmed attacker wallets, and established direct links to two centralized exchanges (OKX and Gate.io) that the attacker used to fund the operation. A police report has been filed with the BVI Police, and we are cooperating with law enforcement to identify the attacker through exchange KYC records.

1. Root Cause

The root cause analysis was provided by the Messina bridge security team. The vulnerability stems from three issues that, combined, allowed the attacker to multiply tokens from a single deposit.

1.1 Identical Events from Bridge and Router

The Messina bridge has two smart contracts that interact with the Wormhole messaging protocol: the Bridge (for normal token transfers) and the Router (for cross-chain hops). Both contracts emit the exact same LogMessagePublished event through the Wormhole Core contract. The only difference is the sender address. This means, from the Guardian network's perspective, events from both contracts look identical.

1.2 Guardians Sign Everything

The Wormhole Guardian network is designed as a protocol-agnostic notary. Guardians only verify that an event was emitted from the Core Wormhole contract and that the block has been finalized. They do not evaluate:

• Which contract emitted the event (Bridge, Router, or any other)
• What the payload contains (transfer, hop, attestation, etc.)
• Whether the underlying business logic is valid

This is by design, as the Guardian network serves multiple protocols with different business logic. The responsibility for validation sits at the smart contract level.

1.3 Missing Validation in hop()

The Router's hop() function lacked critical validation checks. Specifically, it did not prevent:

• Same-chain hops: Calling hop() with the current network as the destination
• Recursive hops: Using a VAA generated by a previous hop() as input for another hop()
• Emitter address validation: Checking whether the VAA came from the Bridge or the Router

2. How the Attack Worked

The attack followed this sequence:

1. Funding: The attacker funded relay wallets on Avalanche using AVAX from OKX and USDt from Gate.io.
2. Seed deposit: A small amount of OPUL was locked on the Avalanche bridge, generating a legitimate VAA signed by the Guardian network.
3. Multiplication: The attacker called hop() repeatedly on the Avalanche Router, using each new VAA as input for the next hop. Each call generated a fresh Guardian-signed VAA for the same token amount.
4. Claims across chains: The attacker claimed the multiplied VAAs on Arbitrum, Ethereum, and BSC, draining OPUL from each chain's bridge escrow vault.
5. Liquidation: Stolen OPUL was rapidly sold on decentralized exchanges (primarily on Arbitrum) for ETH, USDC, and USDT. The attacker continued selling throughout the day.

Attack Timeline

3. What Was Stolen

3.1 Stolen Tokens by Chain

Based on the combined analysis from our forensic investigation and Messina's root cause report, the total stolen tokens break down as follows:

Our independent investigation verified 819 exploit transactions on Arbitrum that drained the Arbitrum escrow vault through unauthorized completeTransfer() calls to the exploited bridge relay contract. The Ethereum and BSC chains were exploited separately using the same hop() multiplication technique.

3.2 Key Infrastructure Addresses

These are victim-side and bridge infrastructure addresses. They are not attacker wallets.

4. Confirmed Attacker Wallets

The following wallets are confirmed as part of the attack infrastructure. Each has a direct, provable on-chain link to the exploit: it either called completeTransfer() on the exploited relay contract, was funded by exchanges to execute the relay phase, received stolen proceeds, or was identified by Messina as a claim destination.

4.1 Primary Recipients (Arbitrum)

These wallets received the largest amounts of stolen OPUL directly from the Arbitrum escrow vault.

4.2 Cross-Chain Recipient

This wallet received stolen OPUL on both Ethereum and BSC, as identified by Messina's analysis.

5. Exchange Evidence

The attacker funded the relay wallets on Avalanche using two centralized exchanges. These exchange-linked transactions represent the strongest leads for identifying the attacker through KYC records.

5.1 OKX Funding (Avalanche)

Three AVAX withdrawals from an OKX-confirmed custodial wallet directly funded wallets that then executed the bridge exploit.

5.2 Gate.io Funding (Avalanche)

Four USDt transfers from a publicly labeled Gate.io wallet funded the same relay wallets.

6. Our Response

• Immediate bridge shutdown: The Messina bridge was halted as soon as the exploit was detected to prevent further drainage.
• Forensic investigation: We conducted a complete on-chain reconstruction of the vault drain, tracing all 819 exploit transactions on Arbitrum and over 1,600 subsequent selling and movement transfers.
• Root cause analysis: Messina's security team identified and documented the technical vulnerability (hop() token multiplication).
• Exchange notifications: OKX and Gate.io were contacted with full transaction evidence and asked to freeze accounts linked to the attacker and preserve KYC records.
• Police report filed: A formal police report has been filed with BVI Police, including all attacker wallet addresses and exchange-linked evidence.
• Ongoing monitoring: All 28 confirmed attacker wallets remain under active monitoring for any movement of remaining funds.

7. How to Verify

All evidence in this report is verifiable on public blockchain explorers. You do not need to trust us. You can independently confirm every claim.

1. Verify the vault drain: Go to the victim vault on Arbiscan, click "Token Transfers," and filter for OPUL. You will see the 819+ exploit outflows alongside a small number of legitimate transfers.
2. Verify any attacker wallet: Click any wallet address in Section 4. On Arbiscan, check its transaction list for calls to the exploited relay contract 0x537816fbb8ec6078fb8b51f3bc35d5444edcb361.
3. Verify exchange funding: The OKX and Gate.io transactions in Section 5 can be verified on Snowtrace (the Avalanche blockchain explorer). The source addresses are publicly labeled as OKX and Gate.io wallets.
4. Verify cross-chain claims: The Ethereum claims can be verified on Etherscan and the BSC claims on BscScan.

← Back to main page