ShapeShift FOX Colony Hack
What happened
On May 13, 2026, ShapeShift's FOX Colony community treasury on Arbitrum was drained of approximately $132,700 in USDC and FOX. The core ShapeShift exchange platform was not affected.
executeMetaTransaction allowed a signed call to execute through the contract itself. DSAuth treated that self-call as authorized, so a privileged resolver change could be reached without the intended access-control boundary.
How it happened
The attacker used the colony's meta-transaction path to make an authorized-looking self-call, replaced the resolver with attacker-controlled routing logic, and then used that routing path to drain treasury assets.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
