What happened
On September 12, 2025, an attacker exploited the swap() function of Kame Aggregator's AggregationRouter on Sei (0x14bb98581ac1f1a43fd148db7d7d793308dc4d80). The function executed a caller-supplied params.executor with caller-supplied params.executeParams without validating either, so anyone could make the router perform arbitrary calls. The attacker used this to call transferFrom() against wallets that still had token approvals on the router, pulling their tokens out.
Kame's post-mortem puts the affected value at about $1,324,535 across 830 users. Kame told users to revoke approvals to the router and a second Kame contract, placed bounties, and negotiated with the main exploiter, who returned about $946,196 in exchange for a 20% bounty. Cryptopolitan separately reported that Kame recovered 185 ETH. Whitehats recovered about $21,901 more, leaving roughly $360,000 unrecovered. Revoke.cash reports that Kame's compensation plan covered about 75% of losses up front from recovered funds and treasury, with the rest paid over time.
How it happened
- Many users had granted the Kame AggregationRouter unlimited or large token approvals so it could route their swaps.
- The attacker called the router's
swap()with a chosenparams.executorandparams.executeParams; Kame's post-mortem says the executor was a Multicall contract (0xcA11bde05977b3631167028862bE2a173976CA11) and the call data encodedtransferFrom(). swap()performed the external call without checking the executor or its call data, so the router carried out the transfers.- Tokens were moved from 830 approving wallets to the attacker, about $1.32 million in total.
- Kame asked users to revoke approvals, then recovered about $946,196 from the main exploiter (for a 20% bounty) and about $21,901 through whitehats.
Protocol details
Evidence
- report @kame_agg incident report x.com
- report Post-Mortem: Kame Aggregator Exploit kameagg.substack.com
- analysis DeFiLlama defillama.com
- analysis The Hidden Danger of Unlimited Token Approvals blog.verichains.io
- analysis 2025 Kame Aggregator Hack: Check If You're Affected revoke.cash
- analysis Kame aggregator recovers 185 ETH after Sei exploit cryptopolitan.com
- analysis Kame Aggregator Hack: How Olympix Would Have Prevented the $1.3M Loss olympix.security
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
