SagaEVM shut down after $7M hack: Stablecoin depeg and liquidity leak

Saga, a layer 1 blockchain protocol, has paused its Ethereum-compatible SagaEVM chainlet after a $7 million exploit resulted in unauthorized fund transfers. The attack involved assets being bridged out of the network, then exchanged for Ether. Although the affected chainlet remains offline, Saga specifies that the network as a whole continues to operate normally.

Chainlet blocked as engineers act to contain exploitation

The protocol confirmed on X that it stopped the chainlet at block 6,593,800 after detecting suspicious activity. Engineers quickly took action to contain the incident and prevent further losses, while an internal investigation was launched. Saga clarified that the exploitation did not compromise the security of the core network, nor the operations of validators or consensus mechanisms.

In an update published on Medium, Saga indicates that the initial findings point to a coordinated attack. The observed activity included multiple smart contract deployments, cross-chain interactions as well as rapid liquidity withdrawals. Despite the scale of the exploit, the team says no validators were compromised and no signing private keys were exposed. Additional security measures have since been deployed.

The incident also affected two stablecoins in the ecosystem, Colt and Mustang. All operations on the impacted chainlet will remain suspended while engineering and security teams conduct a thorough review and prepare a full technical report. Saga says it has identified the wallet receiving the stolen funds and is cooperating with exchanges and bridge operators to restrict any further movement.

Saga Dollar dwindles, TVL falls after cross-channel exploitation

The Saga Dollar, the protocol's main stablecoin pegged to the US dollar, briefly lost its foothold, falling to $0.75 on Wednesday evening according to available data. Network-wide liquidity has contracted sharply, with DeFiLlama estimating that the total value locked (TVL) has fallen from more than $37 million to around $16 million within 24 hours.

As part of its immediate response, Saga has implemented several measures:

• Restriction of cross-chain transfers associated with mining.
• Blocking known attack patterns at the protocol level.
• Added reinforced monitoring rules on chainlets.
• Launching forensic analyzes with external security companies.
• Coordination with exchanges in order to blacklist the attacker's wallets.

Saga specifies that the chainlet will remain offline until remediation efforts are finalized and all remaining risks are addressed. Once the investigation is completed and the results verified, the team plans to release a detailed public postmortem.

The exact cause of the exploitation has not yet been officially confirmed. Independent security researcher Vladimir S. speculated that the attacker could have issued Saga Dollar tokens without collateral, by abusing cross-blockchain communication via custom contract messages.

For his part, an on-chain investigator known under the pseudonym Specter raised the possibility of a private key compromise, while emphasizing that the elements supporting this hypothesis remain limited at this stage.

While cross-chain infrastructure remains a recurring attack vector, this incident adds to a growing list of smart contract exploitations reported in late 2025 and early 2026. Saga says it will continue to share updates as new information becomes available.