L1 Blockchain Saga Hacked for $7 Million! Emergency Chain Halt, Stablecoin Decoupling Causes TVL Halve

Layer 1 Modular Blockchain Saga Hacked on January 21 with $7 million, team urgently paused chain operations, stablecoin depegging and TVL 55% drop exposed cross-chain bridge risks.
(Background briefing: Ethereum transaction volume hits new highs but triggers security alerts! Hacker “dust attack” boosts transaction data, hidden crises behind prosperity)
(Additional background: North Korean hackers set record theft in 2025: stole $2.02 billion in cryptocurrencies, money laundering cycle about 45 days)

On the 21st, Layer 1 Saga revealed a $7 million contract vulnerability, and the official team stopped SagaEVM chain operations at block height 6,593,800. Within hours, the ecosystem stablecoin Saga Dollar lost its 1 USD peg, dropping as low as $0.75, with total locked value (TVL) plummeting from $37 million to $16 million, a 55% decline.

The incident impacts not only the fund pool but also market trust in “interoperability” security logic.

Fund Outflow

DeFiLlama data shows that on the day of the attack, both smart money and retail investors withdrew simultaneously, and large liquidity pools on SagaEVM dried up instantly in the evening. The stablecoin Saga Dollar was originally designed to be 1:1 pegged to USD; after depegging, market quotes temporarily dropped to $0.75, and related stablecoins like Colt and Mustang also experienced varying degrees of discount.

Attack Process

On-chain footprints show that hackers first deployed malicious contracts on SagaEVM, then used cross-chain bridges to unauthorizedly transfer assets such as USDC, yUSD, ETH, tBTC to the Ethereum mainnet, and then exchanged them for ETH for subsequent mixing.

Security communities speculate that the attack may involve “infinite minting” or IBC-assisted contract logic errors, and do not rule out private key leaks, but final conclusions await official disclosure.

To stop further losses, the Saga team first unplugged the system, then contacted centralized exchanges and other cross-chain bridge operators to track and freeze suspicious addresses. SagaEVM remains suspended to this day.