Meter Passport exploit: the “$2.3 million” was printed, not taken

Passport is Meter’s bridge. On BNB Chain it mints wrapped MTRG, 0xbd2949f67dcdc549c6ebe98696449fa79d988a9f, when its relayers confirm MTRG was locked on Meter’s own chain. According to Meter, a flaw in block validation on Meter mainnet let an attacker get fake confirmations through, so the bridge minted tokens that nothing backed. At 13:26 UTC on 24 September it minted 1,000,000,000 wMTRG to 0xEe2EEEED4Ed8580669ED924abEb49f27f7D0Bd65. That wallet had been given its gas a minute earlier by 0x44cf94496091150865E192A86c07B90a9760b43D, which itself was funded through Gas.zip the day before.

A billion tokens at the last traded price looks like millions of dollars, and that is where the headline figure comes from. But a price only means something if someone will pay it, and on BNB Chain almost no one could.

At 13:35 the attacker put 100 million wMTRG into the PancakeSwap MTRG/BUSD pool, 0x4dcA4D427511bC327639b222DA18FA5e334F686F, and the pool paid out about 120 BUSD for it. Between 14:02 and 14:05 it transferred another 400 million straight into the MTRG/BUSD and MTRG/WBNB pools, 0xb95568F806fdBc05DfD51737F27bf1623b3Ee9D2 — but each of its own swap calls that followed failed. Tokens sent into a pool without a completed swap are simply there for whoever swaps next, so whatever those 400 million were worth went to other traders and bots, not to the attacker. A further 50 million sold for 0.0065 WBNB, a few dollars.

It also sent 1.3 million wMTRG back into the bridge, 0x8209815136b35F21B8C0f5AA2E2f915a73530dF9, in two deposits. The last 448.7 million it held until 27 September and then sold on Uniswap v4 for 295.6 USDT, which went to the funding wallet two minutes later. Added up, the attacker’s sales on BNB Chain returned roughly $420 for a billion tokens.

On Ethereum, where wrapped MTRG has the same contract address, there were no mints to the attacker and no large sales between 22 and 28 September — only ordinary trading.

The damage is real, it just is not a pile of stolen dollars. Holders of MTRG saw a flood of unbacked supply hit a thin market, and liquidity providers in the BNB Chain pools were left holding tokens worth next to nothing: by 28–30 September, trades of 150,000–400,000 wMTRG in the MTRG/BUSD pool were returning a few tenths of a dollar. Meter has not yet said what happens to the unbacked supply.

It names nobody, and it covers BNB Chain only. The exploit itself happened on Meter’s mainnet, which we have not traced; any value the attacker took there is not counted here.

Another address, 0x7db6ac6F…, was named in some early coverage. We do not treat it as the attacker. It has bridged MTRG through Passport and traded it on KuCoin and Gate since February 2022, and its two bridge-ins of 1,000,000 wMTRG on 24 September fit that history in dollar terms. Without more evidence we are not listing it.

The two attacker-side addresses on this page — the minting wallet and its funder — are listed on our incident page for this event.