What happened
On October 26, 2026, a 2-of-7 Safe multisig on the Avalanche C-Chain holding approximately $7.45 million in trading inventory was drained due to stale, unlimited token approvals left pointing to an uninitialized address (0x3725bd4d…66155d).
The vulnerability stemmed from a multichain configuration dating back to March 7, 2026, when the team granted unlimited spending allowances (for WAVAX, USDC, WETH.e, and BTC.b) to 0x3725bd4d…66155d. On other EVM chains (Ethereum, Base, Arbitrum), this address hosted the team's custom pool contract. However, on Avalanche, the address was entirely empty and uninitialized because Safe's deterministic CreateCall contract had never been deployed there.
An attacker (0x4c48b79b...) discovered this and deployed CreateCall via the Safe singleton factory, advanced the contract nonce through 12 throwaway deployments, and deployed a sweeper contract at the exact target address (landing at the 13th deployment). This claimed the address and allowed the sweeper to invoke transferFrom using the stale unlimited approvals. However, an MEV bot (0x36b11287…4d21b3) successfully front-ran the transaction in the same block, capturing 3.09M USDC, 350.4K WAVAX, 182 WETH.e, and 10.79 BTC.b (~$7.45M total). The original attacker's transaction reverted. The MEV bot operator agreed on-chain with the Safe owners to return the bulk of the assets in exchange for a 42,500 WAVAX (~$371K) bounty.
Vulnerable / Target Address: 0x3725bd4d…66155d
Victim Safe Address: 0x631fca4a…54b9b8
Original Attacker Address: 0x4c48b79b…38fa0a
MEV Bot Address: 0x36b11287…4d21b3
Original Attack Transaction Hash (Reverted): 0xf1f87d37…331289
MEV Bot Interception Transaction Hash: 0xf88a7960…007ed5
Protocol details
Funds Recovery
Recovered
$7.0M
Net Loss
$447,000
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
