{"id":93424,"date":"2026-01-22T10:55:43","date_gmt":"2026-01-22T07:55:43","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=93424"},"modified":"2026-01-22T11:00:33","modified_gmt":"2026-01-22T08:00:33","slug":"saga-blockchain-hacked-7-million-stolen-stablecoins-depegged","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/saga-blockchain-hacked-7-million-stolen-stablecoins-depegged\/","title":{"rendered":"Saga Blockchain Hacked: $7 Million Stolen, Stablecoins Depegged"},"content":{"rendered":"<p>The Saga Layer 1 blockchain has halted its <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-ethereum-virtual-machine-evm\">EVM<\/a> network following a hack in which attackers stole <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-usdc-stablecoin\">USDC<\/a> worth $7 million.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">SagaEVM has been paused at block height 6593800 in response to a confirmed exploit on the SagaEVM chainlet.<\/p>\n<p>Mitigation is underway, and the team is fully focused on a solution.<\/p>\n<p>Further updates will follow once details are confirmed.<\/p>\n<p>\u2014 Saga \u26cb (@Sagaxyz__) <a href=\"https:\/\/twitter.com\/Sagaxyz__\/status\/2014013472342761896?ref_src=twsrc%5Etfw\">January 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The hackers transferred the funds via a <a href=\"https:\/\/forklog.com\/en\/news\/what-are-cross-chain-bridges\">cross-chain bridge<\/a> and converted them into Ethereum. The team has already identified the hacker&#8217;s wallet.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cThe attack was a coordinated sequence of actions: deploying smart contracts, conducting cross-network operations, and subsequently withdrawing liquidity,\u201d the project&#8217;s blog stated.<\/em><\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">Consequences<\/h2>\n<p>The incident affected only SagaEVM and two of the platform&#8217;s <a href=\"https:\/\/forklog.com\/en\/news\/what-are-stablecoins\">stablecoins<\/a>\u2014<a href=\"https:\/\/medium.com\/%40borrysbpotaka1\/colt-mustang-saga-twin-stablecoins-for-the-next-era-of-defi-30ebb211850c\">Colt and Mustang<\/a>. Both \u201cstablecoins\u201d lost their peg to the dollar.<\/p>\n<p>Another dollar-pegged asset of the project, tickered D, also experienced a depeg, dropping to $0.7.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-364dc6e4704d3261-4284614408747709.webp\" alt=\"image\" class=\"wp-image-273808\"\/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/www.coingecko.com\/en\/coins\/saga-dollar\">CoinGecko<\/a>.<\/figcaption><\/figure>\n<p>In the wake of the hack, the price of the SAGA coin fell by 5.2% to $0.05.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-63491e107de50e77-4284627944293456.webp\" alt=\"image\" class=\"wp-image-273809\"\/><figcaption class=\"wp-element-caption\">Hourly chart of SAGA\/USDT on Binance. Source: <a href=\"https:\/\/ru.tradingview.com\/chart\/?symbol=BINANCE%3ASAGAUSDT\">TradingView<\/a>.<\/figcaption><\/figure>\n<p>The main Saga SSC network, its consensus mechanism, and validators remain secure.<\/p>\n<p>The project team is collaborating with exchanges and bridge operators to recover the stolen funds. SagaEVM will resume operations once developers complete their investigation of the incident.<\/p>\n<h2 class=\"wp-block-heading\">Possible Causes<\/h2>\n<p>Cybersecurity expert Vladimir S. suggested that the attacker exploited a vulnerability in the Saga Dollar smart contract.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Saga EVM has been exploited for $7 million!<\/p>\n<p>An attacker minted D tokens (Saga Dollar) out of thin air with a helper contract that abused IBC mechanisms with custom messages.<\/p>\n<p>Exploit Contract: <a href=\"https:\/\/t.co\/Mv95cI2Ixf\">https:\/\/t.co\/Mv95cI2Ixf<\/a><br \/>Attacker: <a href=\"https:\/\/t.co\/OCLoWB30LB\">https:\/\/t.co\/OCLoWB30LB<\/a><a href=\"https:\/\/t.co\/MeyFZqcNhr\">https:\/\/t.co\/MeyFZqcNhr<\/a>\u2026 <a href=\"https:\/\/t.co\/3ekVOkaRhY\">pic.twitter.com\/3ekVOkaRhY<\/a><\/p>\n<p>\u2014 Vladimir S. | Officer&#8217;s Notes (@officer_secret) <a href=\"https:\/\/twitter.com\/officer_secret\/status\/2014015959174963548?ref_src=twsrc%5Etfw\">January 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cBy creating custom messages or data, the contract bypassed checks in the bridge precompile logic, allowing unlimited issuance of D tokens without any backing,\u201d he explained.<\/em><\/p>\n<\/blockquote>\n<p>A blockchain analyst known as Specter <a href=\"https:\/\/x.com\/SpecterAnalyst\/status\/2014009022597177805\">suggested<\/a> that the attack resulted from a compromised private key.<\/p>\n<p>This week, the DeFi protocol Makina Finance was also hacked, with approximately $5 million withdrawn from one of its <a href=\"https:\/\/forklog.com\/en\/news\/what-are-stablecoins\">stablecoin<\/a> pools.<\/p>\n<p>In 2025, the volume of stolen funds <a href=\"https:\/\/forklog.com\/en\/news\/losses-from-crypto-hacks-reached-3-4bn-in-2025\">reached $3.4 billion<\/a>, the highest since 2022. Three incidents, including the $1.46 billion Bybit hack, accounted for 69% of all losses.<\/p>\n<p>Immunefi CEO Mitchell Amador <a href=\"https:\/\/forklog.com\/en\/news\/major-hacks-spell-doom-for-80-of-crypto-protocols-experts-say\">concluded<\/a> that nearly 80% of cryptocurrency projects cease to exist after major attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Saga Layer 1 blockchain has halted its EVM network following a hack in which attackers stole USDC worth $7 million.<\/p>\n","protected":false},"author":1,"featured_media":93425,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Saga blockchain hacked, $7M stolen, stablecoins depegged.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1111,433,1246,807],"class_list":["post-93424","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-cybersecurity","tag-evm","tag-scammers","tag-stablecoins"],"aioseo_notices":[],"amp_enabled":true,"views":"391","promo_type":"1","layout_type":"1","short_excerpt":"Saga blockchain hacked, $7M stolen, stablecoins depegged.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/93424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=93424"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/93424\/revisions"}],"predecessor-version":[{"id":93426,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/93424\/revisions\/93426"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/93425"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=93424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=93424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=93424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}