Meter's Passport bridge minted about $2.3M of unbacked tokens, then the chain was paused

What happened

On the evening of 23 September 2026, UTC, someone started minting wrapped MTRG on BNB Chain that had nothing behind it. They sold part of it on PancakeSwap in a handful of transactions. The market took the hit: reports put the fall in MTRG and MTR at more than 80%.

Meter is a cross-chain project whose bridge, Meter Passport, moves assets between its own chain and networks such as BNB Chain. The security firm Blockaid flagged the attack while it was still running and estimated about $2.3 million of unbacked tokens had been created.

Meter paused both its blockchain and the bridge, and told users to stop trading the affected tokens. Meter has said the cause was a "block validation flaw". As of mid-October ThreatWire has found no full technical post-mortem.

What is confirmed

Meter's own statements, as relayed by several outlets, say the following.

• The root cause was a flaw in block validation. Meter has not explained what that means in detail.
• The blockchain and the Passport bridge were paused.
• Users were warned that transactions after block 100731417 "may not be honored". Outlets read this as a sign that Meter was considering a chain rollback to undo the mints.

From independent reporting, which we have attributed by name:

• Blockaid first flagged the activity and put the unbacked amount at about $2.3 million, created across a small number of mint transactions. Outlets citing it include Protos, The Crypto Times and Phemex.
• PyramidLedger and Blockchain Breaches both date the start of the attack to about 21:14 UTC on 23 September, and note the price crash that followed.
• Both say no funds had been recovered as of late September.

That is the whole confirmed picture. We have not found a second, independent technical account of the mechanism, and we are not guessing at one.

How it worked

Here we have to be careful, because the public record is thin.

A bridge holds a promise: for every wrapped token on one side, there is a real asset locked, or an equal amount burned, on the other. A bridge mints wrapped tokens only when it is convinced that the promise has been kept.

According to Meter's description, that conviction came from a validation step that could be fooled. In this case it let the attacker mint wrapped MTRG and MTR with no matching lock or burn. After that, nothing about those tokens looked different from honest ones, so they could be sold into a normal market. The sale pushed the price down for everyone who held the real thing.

Meter's own 2022 post-mortem is a useful contrast. In February 2022 an attacker stole about $4.25 million through a different flaw: a deposit method in the bridge's token handler assumed a wrapped native token did not need to be locked or burned, because the funds had supposedly already been moved. Meter says the attacker used that assumption to drain deposits and mint tokens on other chains. The 2022 cause does not tell us what happened in 2026, and we are not suggesting the two are the same.

What is not known

• What the block validation flaw actually was. Meter has not published details.
• Who the attacker is, and where the proceeds went.
• How much of the $2.3 million was sold, how much remains unsold, and whether the unsold part is frozen.
• Whether Meter will roll the chain back, and what happens to legitimate transactions after the stated block.
• Whether holders will be compensated. We found no announced plan.
• Whether the validation code is shared with other chains. Nobody has said.

Where sources disagree

The dollar figure is consistent. The date is not: outlets give 23 and 24 September, which is simply the UTC date change across the same event. The price drop is quoted as "more than 80%" by some outlets and "more than 88%" by others. ThreatWire cannot say which, and neither is a price we have checked.

Lessons

• A mint path needs an independent check. The decision to create a wrapped token should not rely on a single validation result. A cap per block or per hour limits the damage.
• A pause is useful but it comes after the damage. Alerts from monitoring firms started the response here.
• A second incident deserves a public account. Users who lived through the 2022 exploit are owed a clear explanation of what changed since.
• Wrapped assets on thin markets crash quickly. A sale of a few million dollars was enough to wipe most of the price.

What users should do

• Do not buy or trade MTR or MTRG on the strength of the price falling. The tokens' supply and peg are in question.
• If you hold Meter Passport-wrapped assets on BNB Chain, wait for Meter's official statement on how they will be treated.
• Follow only Meter's official channels. Rollback announcements and compensation offers are a favourite hook for phishing.

Sources: Meter's statements as relayed by Protos, The Crypto Times, Phemex, PyramidLedger and Blockchain Breaches, with Blockaid as the original source for the loss estimate. Meter's 2022 post-mortem is linked above. We have not verified the on-chain figures.