Ekubo Protocol Hack

On May 5, 2026, Ekubo Protocol’s EVM-based router extensions were exploited for approximately $1.4M on Ethereum and Arbitrum. The attack targeted users who had granted ERC-20 approvals to specific V2 and V3 extension contracts. While the core protocol and liquidity providers were not affected, the vulnerability allowed an attacker to drain tokens from any wallet with active approvals to the compromised addresses.

The exploit was caused by a lack of authentication in the extension’s IPayer.pay callback mechanism. While the extension verified that the callback was triggered by the Ekubo Core contract, it failed to validate the parameters, specifically the payer, token, and amount contained within the lock payload. These values were forwarded directly from the user who initiated the lock.

Because the extension contract was a trusted spender for many users, an attacker could initiate a lock through the extension and name an arbitrary victim as the "payer." Since the extension did not verify if the payer had actually authorized that specific lock, the Core contract successfully executed a transferFrom call against the victim's wallet. The funds were then pulled into the Core contract and immediately handed over to the attacker as the withdrawal recipient.

Exploited Contracts (ETH):

V2: 0x8ccb1ffd…de60fd

V3: 0x4f168f17…18edf2

Exploited Contract (ARB):

V3: 0xc93c4ad1…9fc47d

Exploit Transaction (ETH): 0x770bc9a1…29daa0

Attacker Address: 0xA911Ff35…3A83e3