What happened
On August 13, 2025, Coinbase's corporate DEX fee-receiver wallet mistakenly granted ERC-20 allowances to 0x Mainnet Settler, a permissionless execution contract. Bots used those standing permissions to pull and swap fee tokens. Coinbase's CSO described the event as an isolated corporate-wallet issue and said customer funds were not affected.
Public reporting put the loss at about $300,000, while a later forensic analysis calculated a higher estimate using a different valuation and scope.
How it happened
- Coinbase's fee wallet issued broad ERC-20 approvals to 0x Mainnet Settler, a contract that anyone can call.
- A monitoring bot detected the approvals and invoked Settler's public execution path.
- Settler used the granted allowance to transfer tokens from the fee wallet; the bot swapped the assets through decentralized liquidity and consolidated proceeds.
- The activity began shortly after the approvals and continued across many token types.
- Coinbase revoked access and rotated the affected corporate-wallet setup; its CSO said no customer funds were involved.
Protocol details
Classification
Ecosystem / Access Control
Protocol Type
CEX
Implementation language
Solidity
Evidence
Proof of concept
1 availableUnderstand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
