Map Protocol Falls 96% After Butter Network Bridge Exploit Mints Quadrillion MAPO

On May 21, the MAPO token of Map Protocol lost 96% of its value in just a few hours. An attacker found a flaw in the Butter Network cross-chain bridge and used it to mint tokens far beyond the legitimate supply. Here is how cross-chain bridges work and why this type of exploit keeps happening.

What happened on May 21?

According to CoinTelegraph, the attack took place during the morning of May 21, 2026. The attacker found a gap in the Butter Network smart contract, a cross-chain bridge within the Map Protocol ecosystem. The system accepted forged transactions as genuine and issued permission to mint new MAPO tokens without any real collateral.

The minted volume was astronomical: a quadrillion tokens, or 10 raised to the power of 15. The entire legitimate MAPO supply is counted in billions. Markets responded fast, and the price dropped 96% within hours. Trading on most platforms slowed sharply or halted entirely.

The Map Protocol team confirmed the attack and temporarily suspended Butter Network operations for investigation. An official statement arrived several hours after the incident.

How does Butter Network work and where was the weak point?

A cross-chain bridge lets users move assets between different blockchains. The basic idea: a token gets locked on the source chain, and the system mints a "mirror" copy on the target chain. This is how Ethereum assets and stablecoins like USDT flow between networks.

Bridge security rests entirely on the reliability of transaction verification. Before allowing any minting on the target chain, the protocol checks that an asset is genuinely locked on the source chain. If that check can be bypassed, the bridge becomes a generator of unlimited tokens with no backing.

That check failed at Butter Network. The attacker fed manipulated data to the verification module so the system accepted transactions that never actually occurred. The smart contract received confirmation of asset locking and issued mint permission. The whole process reportedly took just minutes before the team responded.

• Forged input data: the attacker submitted false proof of asset locking on the source blockchain.
• The verification module accepted this data as valid and passed the command to the smart contract.
• The smart contract automatically granted permission to mint MAPO in the requested amount.
• By the time the team blocked the bridge, the process had already completed.

Why did a quadrillion new tokens erase 96% of the price in hours?

The price of any asset reflects the balance between supply and demand. When tokens appear in a volume hundreds of thousands of times larger than the existing supply, each holder's share of the total drops proportionally. Holders start selling, sales press on the price, and the drop accelerates.

Think of it this way: a printing press suddenly running 100,000 times faster than a central bank. Each printed note loses purchasing power in direct proportion. The same applies to tokens, except the market reacts automatically through algorithms and order books.

96% in a matter of hours is not a surprise. It is the direct math of mass inflation, amplified by fast selling from those who first spotted the abnormal MAPO volume on-chain.

Has this type of attack happened before?

Yes. Cross-chain bridge exploits have become a distinct attack category in DeFi. The Ronin Bridge hack in March 2022 cost the Axie Infinity ecosystem $625 million. Nomad Bridge lost $190 million in August of that year through a similar verification flaw. Wormhole Bridge lost $320 million in February 2022 via signature forgery.

The pattern repeats: attackers find a weak point in the transaction verification mechanism, bypass the protection, and gain access to unlimited minting or fund withdrawal. Audits reduce the risk but do not eliminate it. Complex verification systems are hard to test against every possible attack scenario.

A full technical post-mortem from the Map Protocol team should clarify whether Butter Network went through a thorough enough audit and what was missed.

What now for MAPO holders?

At the time of publication, no official compensation announcement had been made. The team confirmed the bridge suspension and is conducting an investigation. After incidents like this, projects typically publish a post-mortem detailing the vulnerability, run a follow-up audit, and announce a recovery plan.

Two scenarios exist for MAPO holders. If the team introduces a mass token burn mechanism, the protocol could rebuild trust. If not, the price stays at post-attack levels and the project gradually loses its user base. Full recoveries after such exploits have happened, but they are rare.

The situation is a reminder that tokens from lesser-known protocols and cross-chain bridges carry higher risks than first-tier assets. Portfolio diversification and understanding the specific risks of each project remain the best defenses.