Demex bridge exploit hack — September 2026

Demex, a derivatives exchange running on its own chain, lost about $191,929 from its cross-chain bridge on 25 September 2026: 64.78 WETH, about $174,495, on Ethereum and 22.49 WBNB, about $17,434, on BNB Chain. According to Demex’s post-mortem, the attacker bought 95 nLEND on the exchange’s order book for about $60 at 13:03 UTC. A direct request to register a new token pairing was rejected as unauthorised at 18:22 UTC, but a fifth attempt at 18:29 UTC succeeded. It went through Demex’s generic execute flow, which triggered a token deployment and accepted a falsified deployment report naming the canonical WETH contract as the new nLEND contract. Both the bridge contracts and Demex’s bridge module accepted the pairing, so the bridge treated nLEND and WETH as the same asset.

The attacker then withdrew 87.27 nLEND, worth about $10, and the bridge paid out WETH unit for unit. This registry read the Ethereum payout: the bridge’s gateway contract released 64.7759 WETH in block 26,056,462 at 19:09:59 UTC. The same sequence then paid out WBNB on BNB Chain. Demex’s $50,000 daily withdrawal cap did not trigger, because it priced the token deducted, worth $10.47, rather than the value released. An attempt against Base at 19:47 UTC was stopped when the team’s multisig halted the chain, 52 minutes after the first withdrawal. About $976,000 in bridge reserves was protected. The stolen WETH was unwrapped and moved on, and the BNB bridged to Ethereum.

Demex announced the halt on 26 September and published its post-mortem on 29 September. On 13 October it said it would close the platform permanently, top up the roughly $192,000 lost to the exploit itself, and settle every account at the balances and prices of the moment the chain halted, with 30 days to dispute the settlement and a 90-day withdrawal window after that. Nothing has been recovered from the attacker, who has not been identified.