Layer-1 Protocol Saga Temporarily Halts SagaEVM Chain Following $7M Security Breach

Layer-1 network Saga has temporarily paused its SagaEVM chain after a security incident that saw nearly $7 million in tokens transferred to Ethereum. The team is currently investigating the situation and has halted the network to ensure the safety of its community.

Key Takeaways

Saga paused its SagaEVM chain after nearly $7M was exploited and moved to Ethereum.
The decision was made for community safety and will remain until the vulnerability is addressed.
The wallet used in the exploit has been identified, and efforts are in place to blacklist it.
No compromise of the mainnet or validator security has been detected.
Crypto theft has been a growing issue, with Chainalysis estimating losses of over $3.4B in 2025.

Saga

Saga Pauses SagaEVM Chain Due to Security Breach

The Layer-1 protocol, Saga, has made the decision to pause its SagaEVM chain after discovering an exploit that resulted in the movement of nearly $7 million worth of tokens to the Ethereum network. This action was taken as the team continues to investigate the situation thoroughly.

Saga mentioned that the chain was halted at block height 6593800 on January 21, following the identification of the security incident, and it will remain paused “out of an abundance of caution.” The team is focused on assessing the full impact of the exploit and implementing necessary security patches to strengthen the network.

A statement from the Saga team on Wednesday emphasized the importance of community safety: “We recognize that a pause is disruptive. We made this decision because the safety of our community comes first. Once remediation is complete, we will publish a more comprehensive technical post-mortem.”

Update on the $7M Exploit Investigation

In their latest investigation update, Saga revealed that nearly $7 million in assets, including USDC, yUSD, ETH, and tBTC, were transferred to the Ethereum mainnet, and they have identified the wallet that received these funds.

The Saga team is actively working with exchanges and bridge operators to blacklist the attacker’s wallet address and assist in recovery efforts. Additionally, they are conducting forensic analysis using historical data and trace execution records to understand the breach better.

The nature of the attack was described by Saga as a coordinated effort that involved deploying contracts and executing cross-chain activities, ultimately leading to quick liquidity withdrawals.

Crypto Theft Statistics and Implications

Furthermore, analysis of the incident has indicated that the attacker bridged the assets to Ethereum and then converted the stolen funds into ETH through swaps.

According to Saga, while this incident affected the SagaEVM chainlet as well as Colt and Mustang, it did not compromise the Saga SSC mainnet. There was also no evidence found indicating any breach in validator security, signer key leakage, or consensus failures.

The breach underscores ongoing vulnerabilities within the cryptocurrency space. Recent data from Chainalysis estimates that the industry experienced over $3.4 billion in thefts throughout 2025, with significant hacks being a major contributor to these losses.