Mezo Fixes veBTC Exploit After 5.52 BTC Is Taken

Mezo has published a post-incident report on an October 5 exploit affecting its veBTC vote-escrow contract. The project said an attacker transferred 37 positions from 36 holders and bridged approximately 5.52 BTC off the chain. The vulnerability has been fixed, the network has resumed operation and Mezo says affected users will be reimbursed from protocol-owned funds.

Readers can follow other verified digital-asset developments in the OrangeX.com news hub.

How the veBTC exploit worked

veBTC represents locked bitcoin positions and voting power as NFTs. Its VotingEscrow contract uses external Solidity libraries and supports meta-transactions through a trusted forwarder. The forwarder verifies an off-chain signature and appends the sender address to calldata.

According to Mezo, the problem appeared when execution moved into an external library. Solidity constructed a fresh argument buffer that did not preserve the appended sender address. A crafted parameter then caused the contract to read attacker-controlled bytes as the authenticated sender. The attacker targeted positions that were unlocked but had not yet been redeemed, allowing the BTC to be withdrawn and bridged away.

The event adds a technical security dimension to broader ecosystem developments covered in OrangeX.com project reporting.

Response, recovery and remaining uncertainty

Mezo's timeline places the transfers between 18:54 and 19:06 UTC on October 5. The team detected anomalies the next morning, paused bridge withdrawals, halted the chain, identified the flaw and restored service after disabling meta-transactions. It also contacted security responders, exchanges and law enforcement.

Mezo said balances will be sent directly to affected wallets and warned users not to follow recovery links. It offered the attacker a 20% bounty for returning 80% of the assets by October 14. That recovery remains unresolved. Security and regulatory controls remain connected topics, as shown in OrangeX.com coverage of the latest market-framework consultation.

OrangeX.com Analysis

The confirmed facts are the loss size, affected-position count, corrected attack path and reimbursement commitment. The incident shows how two individually common design choices—library-based contract splitting and trusted-forwarder meta-transactions—can create an unexpected authorization failure when combined.

The fix and reimbursement reduce immediate user impact, but they do not erase the design lesson. Audits and bug bounties missed the interaction, so continuous monitoring, narrow feature surfaces and automated pause controls deserve as much attention as pre-launch review. Asset recovery and the attacker's response remain pending and should not be treated as complete until Mezo publishes another verified update.