Saga Pauses EVM Chain After $7M Smart Contract Exploit

Highlights:

• SagaEVM paused after a $7 million exploit drained funds and triggered an investigation.
• Stablecoin peg collapsed to $0.75, TVL plunged from $37M to $16M.
• Saga coordinates with exchanges, blacklists the attacker’s wallet, and prepares a detailed post-mortem report.

Layer 1 protocol Saga has paused its SagaEVM chain after a security breach drained nearly $7 million, the project confirmed on Wednesday. The exploit led to the unauthorized withdrawal of USDC, which was then bridged out of SagaEVM and converted into Ethereum. “SagaEVM remains paused while we finalize the results of our investigation into the Jan 21 exploit,” Saga wrote on X, noting that the network stopped at block height 6593800 after suspicious activity was detected. 

Advertisement

SagaEVM has been paused at block height 6593800 in response to a confirmed exploit on the SagaEVM chainlet.

Mitigation is underway, and the team is fully focused on a solution.

Further updates will follow once details are confirmed.

— Saga ⛋ (@Sagaxyz__) January 21, 2026

Saga Investigates Attack and Freezes Wallet

Meanwhile, the Saga team confirmed they have identified the wallet holding the stolen funds and are actively working with exchanges to blacklist it. They will keep SagaEVM offline until they complete the investigation and apply the necessary fixes. Saga confirmed the incident did not impact its main infrastructure, including the SSC mainnet or core consensus layer. The team found no signs of validator compromise, consensus failure, or leaked signer keys.

A security expert on X, Vladimir S, suggested the attacker could have minted unlimited Saga Dollars. He explained, “By crafting custom messages or payloads, the contract bypassed validation in the precompile bridge logic, enabling infinite minting of $D tokens without collateral.”

Saga EVM has been exploited for $7 million!

An attacker minted D tokens (Saga Dollar) out of thin air with a helper contract that abused IBC mechanisms with custom messages.

Exploit Contract: https://t.co/Mv95cI2Ixf
Attacker: https://t.co/OCLoWB30LBhttps://t.co/MeyFZqcNhr… pic.twitter.com/3ekVOkaRhY

— Vladimir S. | Officer's Notes (@officer_secret) January 21, 2026

Another on-chain investigator, Specter, speculated the exploit might have resulted from a private key compromise but admitted there is “Not much info” available at this time.

Saga Stablecoins Lose Peg, TVL Drops Sharply After Exploit

Alongside the SagaEVM chainlet, Saga’s other stablecoins, Colt and Mustang, suffered impacts. The engineering and security teams will keep the chain paused until they complete their investigation and publish a detailed post-mortem.

Consequently, Saga’s US dollar-pegged stablecoin lost its peg on Wednesday around 10:16 pm UTC, dropping to $0.75, according to CoinGecko. This sudden shift alarmed users and prompted wider scrutiny of the platform’s security. The total value locked on Saga also suffered a sharp decline. DefiLlama reports the TVL fell from over $37 million to $16 million within 24 hours, highlighting the exploit’s immediate impact on investor confidence.

Saga Takes Steps to Contain Risks After Security Incident

Saga is working to minimize risks by taking the following steps. The engineering teams are analyzing the code of the chainlet, informing the exchanges, and ready to enforce the blacklisting rules on the bridge operators.

The company will publish a technical post about what happened, how they fixed the issue, and what they are doing to prevent it in the future. “We’re working with partners on remediation and will publish a post-mortem once findings are fully validated,” the project added. The Saga breach comes amid a rise in smart contract attacks across multiple networks. Saga is now working to strengthen its systems and reduce risks.

Advertisement