Leaderboard
773All-time rank
M
Maestro
Oct 23, 2023
$500K
Lost
$500K
Recovered
$465K
Net loss
$35K
Majority93% recovered
A vulnerability in the Maestro Router 2 contract behind a Telegram trading bot allowed attackers to execute arbitrary external calls, pulling tokens from user wallets that had granted the router approvals. Maestro identified and fixed the exploit within about 30 minutes and paused trading.
How the exploit worked
View reproducible PoCArbitrary External Call.
Lost: ~$280ETH
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Oct 23, 2023Exploit executed — $500K drained via arbitrary external call
- Attributed to Unknown
- Recovery status Majority 93%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)