The team behind Saga, a blockchain platform designed to simplify the launch of bespoke blockchains and decentralised applications, announced it has temporarily shut down its network after an attacker exploited protocol vulnerabilities and stole approximately $7 million in cryptocurrency assets. The incident was confirmed by the project’s developers on 22 January 2026.
The theft involved Ethereum (ETH) and several stablecoins, including USD Coin (USDC), yUSD, and tBTC, according to the update from Saga. The team said it had identified the wallet used by the exploiter and was working with cryptocurrency exchanges and cross-chain bridge services to recover some of the stolen funds. The network suspension was intended to prevent further loss and allow developers to investigate and remediate the issue.
Saga described the security incident as involving a “coordinated sequence of contract deployments, cross-chain activity and subsequent liquidity withdrawals” that enabled the attacker to extract assets from the protocol. The project’s consensus mechanism and validator infrastructure were reported to remain secure, and the team said that private signing keys had not been compromised. Saga has implemented additional safeguards designed to prevent similar exploit techniques in future operations.
The platform’s network, often referred to as SagaEVM, supports decentralised finance (DeFi) services, gaming applications, and other blockchain-based solutions. Developers said the broader network architecture remained sound despite the exploit, and that network operations would resume once security assessments and corrective work were complete.
The response to the theft follows a pattern of asset losses in the cryptocurrency sector, where attackers use complex smart contract interactions and weaknesses in liquidity protocols to extract funds. In many recent incidents, project teams have paused services after identifying irregular transactions to limit further damage, while blockchain analysts track stolen assets through public ledger data to assist with recovery efforts.
Saga’s announcement underscored that the investigation was ongoing at the time of reporting. The project’s developers have not provided a timeline for the full restoration of network services but said they would communicate further updates as they work with partners in the cryptocurrency ecosystem to secure assets and strengthen protocol defences.