Saga Security Incident Escalation: $7 Million Vulnerability Causes Stablecoin Depegging and Sidechain Downtime

January 22 News, Layer-1 blockchain protocol Saga confirmed that its SagaEVM sub-chain was urgently halted due to a security vulnerability involving approximately $7 million. The incident led to some stablecoins being transferred and exchanged for ETH across chains without authorization, causing a brief disruption in USD-pegged assets within the Saga ecosystem.

In an official statement, the Saga team announced that the Ethereum-compatible sub-chain was suspended at block height 6,593,800, and an emergency response was initiated. Engineers conducting an initial investigation found that the attack involved a series of carefully designed contract deployments, cross-chain calls, and subsequent liquidity withdrawals. However, the network layer’s consensus, validators, and signature keys were not compromised, and the main chain structure remains intact.

Besides SagaEVM, stablecoins Colt and Mustang within the platform were also affected. Following the news, Saga’s USD-pegged stablecoins temporarily dropped to about $0.75 in the secondary market, deviating significantly from the 1:1 peg. Additionally, DeFi data showed that Saga’s TVL decreased from over $37 million to approximately $16 million within 24 hours, reflecting rapid capital withdrawal pressure.

Saga disclosed that the relevant attack addresses have been identified and are being coordinated with cross-chain infrastructure providers to blacklist the involved wallets and restrict further transfers. The sub-chain will remain paused until the engineering and security teams complete a more in-depth audit and release a full incident analysis.

Several security researchers also offered different perspectives. Vladimir S suggested that the attacker might have exploited the IBC mechanism and custom messages to bypass bridge verification logic, enabling “infinite issuance” of Saga Dollars, which were then cross-chain converted to ETH. On-chain analyst Specter proposed that some signs could also indicate private key leakage, but more on-chain data is needed for confirmation.

This incident serves as a reminder to the market that cross-chain and stablecoin mechanisms, while rapidly expanding, remain among the most risky aspects of the DeFi ecosystem. Whether Saga can restore user trust through subsequent fixes and compensation will be a key factor in its ecosystem’s future development.