MAP Protocol (Butter Bridge MAPO mint) hack — May 2026

MAP Protocol's Butter Bridge V3.1 minted about one quadrillion MAPO, some 4.8 million times the token's legitimate supply of about 208m, to a fresh address on Ethereum on 20 May 2026, at 16:13:59 UTC. Blockaid flagged it the same day.

ButterNetwork, which built the bridge, said an abi.encodePacked collision across dynamic-bytes fields in the bridge's retry path let a forged retry pass the guard check. According to Blockaid, the attacker first sent a legitimate, oracle- and multisig-signed bridge message to a precomputed address with no code, so that the bridge stored it for retry, then deployed a contract at that address and re-ran the retry with the message data rearranged so that it hashed to the same value.

This registry read the attacker's address: a minute and a half after the mint it sold one billion MAPO into a Uniswap pool for 52.21 ETH, about $111,000 at the time, and kept the rest, which could not be sold for anything near its screen value. That realised figure is recorded; The Crypto Times put the proceeds at about $180,000, kept as the upper end. ButterNetwork paused ButterSwap while it patched and redeployed the bridge, and on 27 May MAP Protocol announced new MAPO contracts on Ethereum and BNB Chain together with a user-protection and compensation plan.