Modular Layer 1 blockchain Saga suffered a $7 million smart contract exploit on Jan. 21, leading the team to halt SagaEVM at block height 6,593,800. The shutdown was followed by immediate stress across the ecosystem, with Saga Dollar losing its dollar peg and falling to a low of $0.75.
The damage spread quickly across on-chain liquidity. Saga’s total value locked fell from $37 million to $16 million, a drop of 55%. The incident hit more than a single protocol balance sheet and raised fresh concerns about the security assumptions behind cross-chain connectivity.
Liquidity drained from SagaEVM within hours
Data from DeFiLlama showed that both Smart Money wallets and retail users pulled funds on the day of the attack. Large liquidity pools on SagaEVM dried up rapidly later in the day. Saga Dollar, which was designed to maintain a 1:1 peg with the U.S. dollar, traded as low as $0.75 after the break.
The pressure did not stop there. Related stablecoins in the same ecosystem, including Colt and Mustang, also traded at discounts, showing that the exploit affected pricing confidence across multiple assets.
On-chain traces point to bridge-based asset transfers
On-chain activity indicates that the attacker first deployed a malicious contract on SagaEVM, then used a cross-chain bridge to move USDC, yUSD, ETH, and tBTC to Ethereum without authorization. After the transfers, the assets were swapped into ETH, a move seen as preparation for later mixing activity.
Security researchers have floated several possible explanations, including an “infinite mint” issue, a logic mismatch in an IBC-related helper contract, or a private key leak. No final official conclusion has been released.
Team contacted exchanges and bridge operators after halting the chain
To contain the losses, the Saga team shut down chain operations and then contacted centralized exchanges and other bridge operators to track and freeze suspicious addresses. SagaEVM remains paused based on the latest available information.
The sequence was sharp: exploit, chain halt, stablecoin depeg, then a steep TVL decline. It shows how quickly a vulnerability in cross-chain infrastructure can spread into liquidity conditions and asset pricing across an ecosystem.