Leaderboard
724All-time rank
Unibot
Oct 31, 2023
$640K
Lost
$640K
Recovered
$0
Net loss
$640K
Unrecovered0% recovered
On October 31, 2023, Unibot's newly-deployed unverified router contract contained a call injection vulnerability allowing attackers to insert arbitrary transferFrom() calls and drain $640,000 in approved tokens from user wallets. The stolen funds were moved to Uniswap then Tornado Cash.
How the exploit worked
View reproducible PoCArbitrary External Call.
Lost: ~$83,944 USD$
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Token Approval Abuse
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Oct 31, 2023Exploit executed — $640K drained via token approval abuse
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)