Hashflow

A vulnerable function in Hashflow's contract allowed attackers to trigger transferFrom() on approved user tokens. The attacker exploited an approve-related issue across five chains, draining approximately $605K.

The white-hat nature of the attack was later confirmed, and a recovery function was provided by the attacker, with Hashflow committing to compensating all affected users.