Saga Halts SagaEVM Chainlet After $7M Exploit Triggers Stablecoin Depeg and Liquidity Drop

Saga, a Layer-1 blockchain protocol, has paused its Ethereum-compatible SagaEVM chainlet after a $7 million exploit triggered unauthorized fund transfers. The attack involved assets being bridged out of the network and swapped into Ether. Although the affected chainlet remains offline, Saga says the broader network continues to operate normally.

Chainlet Locked Down as Engineers Move to Contain Exploit

The protocol confirmed on X that it halted the chainlet at block height 6,593,800 after detecting suspicious activity. Engineers moved quickly to contain the incident and prevent further losses, while an internal investigation was launched. Saga said the exploit did not compromise core network security, validator operations, or consensus mechanisms.

In a follow-up update published on Medium, Saga reported that early findings suggest a coordinated attack. The activity included multiple smart contract deployments, cross-chain interactions, and rapid liquidity withdrawals. Despite the scope of the exploit, the team said no validators were compromised and no private signer keys were exposed. Additional security safeguards have since been implemented.

The incident also affected two ecosystem stablecoins, Colt and Mustang. All operations on the impacted chainlet will remain paused while engineering and security teams conduct a deeper review and prepare a comprehensive technical report. Saga said it has identified the wallet that received the stolen funds and is coordinating with exchanges and bridge operators to restrict further movement.

Saga Dollar Depegs, TVL Slumps After Cross-Chain Exploit

Saga Dollar, the protocol’s primary U.S. dollar–pegged stablecoin, briefly lost its peg, dropping to $0.75 late Wednesday, according to data. Liquidity across the network declined sharply, with DeFiLlama estimating that total value locked fell from over $37 million to roughly $16 million within 24 hours.

As part of its immediate response, Saga implemented several measures:

• Restricted cross-chain transfers associated with the exploit.
• Blocked known attack patterns at the protocol level.
• Added enhanced monitoring rules across chainlets.
• Initiated forensic reviews with external security firms.
• Coordinated with exchanges to blacklist attacker wallets.

Saga said the chainlet will remain offline until remediation efforts are complete and all residual risks are addressed. Once the investigation concludes and findings are verified, the team plans to publish a detailed public post-mortem.

The root cause of the exploit has not yet been officially confirmed. Independent security researcher Vladimir S. suggested the attacker may have minted unbacked Saga Dollar tokens by abusing inter-blockchain communication via custom contract messages. 

Separately, an on-chain investigator known as Specter raised the possibility of a private key compromise but emphasized that evidence supporting this theory remains limited.

As cross-chain infrastructure continues to be a frequent attack vector, the incident adds to a growing list of smart contract exploits reported in late 2025 and early 2026. Saga said it will continue to share updates as more information becomes available.