MAPO Plunges After Major Butter Network Cross-Chain Bridge Exploit
MAPO, the native token of the Map Protocol ecosystem, sold off sharply this week after an exploit tied to Butter Network's cross-chain bridge enabled an attacker to mint an outsized amount of tokens.
Reports say the vulnerability, linked to the bridge's Solidity smart-contract layer, was used to create roughly one quadrillion MAPO—far above the legitimate circulating supply. The sudden surge in supply sent MAPO sliding from about $0.003 to nearly $0.0001 within hours.
Blockchain security firm Blockaid said the attacker used a newly created externally owned account to sell roughly 1 billion MAPO into Uniswap liquidity pools, draining about 52 ETH—worth around $180,000 at the time. The attacker is still believed to control close to 1 trillion MAPO, raising concerns about further sell pressure across decentralized exchanges and liquidity pools, and potential knock-on risk for any centralized venues where the token may be listed.
Map Protocol said the issue stemmed from the Solidity contract layer rather than compromised private keys or broken light clients. Blockaid's analysis indicates the attacker first submitted a legitimate oracle multisig-signed message, then deployed a malicious contract to a targeted address and resent a manipulated retry message that appeared valid because it produced the same hash structure. The bridge subsequently authorized the large-scale mint.
In response, Map Protocol paused its mainnet and initiated a migration process while the investigation continues. Butter Network also paused ButterSwap, saying user funds were not directly at risk. The team said it will announce a new contract address and take an asset snapshot to support migration; tokens associated with attacker-controlled wallets are expected to be invalidated and excluded from future conversions.
The incident adds to a difficult month for DeFi security, with at least 18 protocols reported to have suffered breaches or exploits, including THORChain, Transit Finance, Echo Protocol, TrustedVolumes, Verus Protocol's Ethereum bridge, Ekubo, and RetoSwap.
