Two long-established South Korean crypto exchanges, Bithumb and Coinone, placed MAP Protocol’s native token MAPO under investment warning status as of May 21 and suspended deposits and withdrawals. Both exchanges cited suspected security issues as the reason behind the decision. Behind the move lies a bridge attack involving one of the strangest figures in crypto history.
One Quadrillion Tokens Were Minted
The attack that triggered the incident targeted Map Protocol’s Butter Bridge V3.1 infrastructure on May 20. The attackers exploited a vulnerability in the bridge’s smart contract by combining message replay and address manipulation methods. The process worked like this: the attacker first initiated a legitimate MAP-to-ETH bridge message that passed oracle and multisig verification; then they resent a fake “retry” message that appeared to carry the same hash value. The bridge accepted this message as valid and executed a massive token mint.
The result was almost absurd in numerical terms: the attackers minted 1 quadrillion MAPO tokens, an amount 4.8 million times larger than the real circulating supply of around 208 million. The minted tokens were sent from the zero address to the wallet 0x40592025392BD7d7463711c6E82ED34241B64279.
The attacker sent around 1 billion of these tokens to Uniswap and drained approximately 52 ETH from liquidity pools, worth around $180,000 at the time. The remaining nearly one quadrillion tokens continue to pose a threat to other pools and potential exchange listings.
According to security firm Blockaid, no private key was stolen and no light client was compromised; this was a classic Solidity security vulnerability.
Price suffers sharp decline
Before the attack, MAPO price was trading near $0.003. After the incident, the token fell as low as $0.00013, with its 24-hour loss exceeding 95%. During the sharpest phase of the drop, the lower end of the 24-hour range reached $0.0000926. The chart almost turned from a flat line into a steep cliff; the candle marking May 20 breaks exactly at that point.
A partial recovery followed afterward. As of May 21, MAPO is trading around $0.0023838, still down 22% on the day. Its weekly loss stands at 31.56%, while its monthly loss is recorded at 27.23%. Daily trading volume exceeded $4.3 million during the period of extreme volatility. It is still too early to say whether the recovery is real or merely a temporary breather after panic selling.
Exchange pesponse
Bithumb announced at 1:55 a.m. local time that it had temporarily suspended MAPO deposits and withdrawals due to suspected security concerns. Coinone took a similar step with its own announcement. Both exchanges said the decision was made under South Korea’s virtual asset user protection regulations; transactions will remain suspended until network stability is restored. Whether trading support will be removed entirely depends on the outcome of the investigation.
Response From Map Protocol and Butter Network
Map Protocol and Butter Network teams moved quickly after the exploit was detected and halted bridge operations to limit potential additional damage. MAP Protocol also shut down the bridge between MAPO ERC-20 tokens and the MAPO mainnet. This is a standard precaution in bridge security incidents; it gives teams time to identify the exact attack vector.
The incident further worsened crypto’s security record for May. At least 18 DeFi and blockchain protocols, including THORChain, Verus Protocol’s Ethereum bridge, Transit Finance, TrustedVolumes, Ekubo, Echo Protocol and RetoSwap, were attacked during the month. Cross-chain bridges remain one of the most attractive infrastructure targets for attackers; previous major breaches involving Nomad, Wormhole and Ronin also fell into the same category.
Map Protocol positions itself as a cross-chain infrastructure layer using light client and MPC-based threshold signature technology for BTC, stablecoin and tokenized asset transfers. The attack appears to have targeted the bridge’s message verification layer, affecting this specific component rather than the broader network infrastructure.
