Ekubo Router Exploit Drained $1.42 Million From 31 Addresses

An exploit in Ekubo Protocol routers drained an estimated $1,419,543 from 31 addresses on May 5, highlighting how token-spending approvals can remain active after users disconnect from an app.

The detailed tally covers 34 address-token combinations. One address accounted for about 98% of the losses, while the other 30 lost roughly $24,000 combined. The estimate is about $1.42 million.

Attackers added bytes to transaction data that the router interpreted as identifying whose tokens would pay during settlement. That let them draw tokens from addresses that had previously approved the router to spend them.

Four immutable deployments were involved: two V2 routers and one V3 router on Ethereum, plus a V3 router on Arbitrum. Ekubo updated the router code in its repository and changed its interface to stop routing through the affected deployments. Those changes did not alter contracts already deployed on the networks. Finite allowances granted to the affected routers were revoked, leaving unlimited approvals as the remaining exposure.

An ERC-20 approval gives a contract permission to transfer tokens from an address up to a specified allowance. The approval is recorded on-chain, separately from a wallet’s connection to an app, so disconnecting does not change it. Reducing or revoking an allowance requires an on-chain transaction; revocation also requires a network fee.

On June 15, Ekubo’s DAO approved a $300,000 contribution in USDC to a recovery fund, and the proposal was executed. The fund sets a cap for each address, while identified losses total about $1.42 million.

A draft proposal, ERC-8255, would let token contracts set default expiration periods for approvals and support requests for shorter periods. It remains a draft, and token projects would need to implement its rules for them to apply.