Ekubo Router Exploit Drained $1.42 Million From 31 Addresses

An exploit in Ekubo Protocol routers drained an estimated $1,419,543 from 31 addresses on May 5, highlighting how token-spending approvals can remain active after users disconnect from an app. The detailed tally covers 34 address-token combinations. One address accounted for about 98% of the losses, while the other 30 lost roughly $24,000 combined. The estimate is about $1.42 million. Attackers added bytes to transaction data that the router interpreted as identifying whose tokens would pay during settlement. That let them draw tokens from addresses that had previously approved the router to spend them.

Source: TokenPost