Someone opened a fresh WAX account, waited 40 minutes, then set the bridge's withdrawal fee to minus the withdrawal.
WAX's multi-chain bridge links the gaming chain to Solana and Ethereum. A withdrawal charges you the amount plus a fee, and per Blockaid, nothing stopped the fee from being negative. Make it the negative of the amount and the charge comes to zero, while the bridge still logs a full withdrawal.
Solana and Ethereum read that record and paid out: about 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH and 0.11 WBTC over five transactions, roughly $90,500 by SlowMist's count. WAX says only a bridge contract was hit, not WAXP or the main chain, and paused bridge processing.
Blockaid calls the other two chains' payouts "honest." They checked the receipt. Nobody checked the minus sign.