Rubic Hack

REPORTED LOSS $1.4M
Medium Router Exploit ethereum

What happened

Quick Summary

USDC balances of Rubic’s users have been drained. The current losses reached $1.42M.

Details of the Exploit

All USDC approved to the RubicProxy contract got under the risk of being drained after the USDC address was added into the list of available routers in the RubicProxy contract.

Through the routerCallNative()  function, the attacker could call safeTransferFrom() on the USDC contract inputting user addresses, which have approved their USDC balances to be spent by RubicProxy, as the “from” parameter.

Block Data Reference

The attacker address:

https://etherscan.io/address/0x001b91c7…0b6ee9

The exploit transactions:

https://etherscan.io/tx/0x9a97d856…8e7d46

https://etherscan.io/tx/0x6551b933…e36e56

The “add available router ” transaction:

https://etherscan.io/tx/0x30679e7b…1bbe66

Case & protocol details

Classification Protocol Logic / Exchange (DEX) / Access Control
Protocol Type DEX Aggregator
Affected asset / contract RBC
Implementation language Solidity
Official Website rubic.exchange/
Protocol Twitter/X @CryptoRubic

Security review history

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Proof of concept

1 available

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Hyperdrive HL $782K

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes