Layer 1 protocol Saga suffered a security breach in its SagaEVM chain, which wiped out nearly $7 million and prompted the project to pause the network. At the same time, it is completing its investigation and recovery efforts, according to a blog post.
According to on-chain analysis, the attacker minted Saga Dollar (D) tokens without collateral, bridged the assets to Ethereum and converted a large portion of them into over 2,000 ETH worth over $6 million, with another $800,000 staked in Uniswap V4 liquidity positions.
Saga suspended the SagaEVM chain after the incident was identified on January 21 and has suspended the chain “out of an abundance of caution” while it assesses the full extent of the exploit, addresses the vulnerability and strengthens overall system security.
SagaEVM remains on pause while we finalize the results of our investigation into the January 21 exploit.
We are working with partners on recovery and will publish a post-mortem once the findings have been fully validated. $7 million in USDC was bridged and converted into ETH.
The funds raised were…
— Saga ⛋ (@Sagaxyz__) January 22, 2026
“We are working with partners on recovery and will publish a post-mortem once the findings are fully validated,” Saga said.
The team acknowledged that suspending the chain is disruptive to users, but emphasized that protecting the community’s funds and the integrity of the protocol is a priority. Saga said it will release a detailed technical post-mortem once the recovery steps are completed and the conclusions fully verified.
Protocol that works to blacklist the attacker
According to Saga, it has identified the wallet that received the retrieved assets.
Saga is working with exchange and bridge operators to blacklist the attacker’s address in an effort to limit the movement of the stolen funds and support any recovery efforts. The team also conducts a forensic analysis using archival data and execution traces to reconstruct the attack path.
Saga said the incident did not impact the broader infrastructure, including the SSC mainnet or core consensus layer, and found no evidence of validator compromises, consensus failure or leaked signer keys.
The attack comes at a time when crypto exploits are common, involving data from Chain analysis saying that losses in 2025 amounted to more than $3.41 billion.
Related news:
Best Wallet – Diversify Your Crypto Portfolio
- Easy-to-use, feature-driven crypto wallet
- Get early access to upcoming token ICOs
- Multi-chain, multi-wallet, non-custodial
- Now in the App Store, Google Play
- Stake to earn native token $BEST
- 250,000+ monthly active users
#Saga #hacked #million #pauses #SagaEVM #chain