Ekubo v2 locker exploited for $1.38M via missing access control allowing attacker to forge fund transfers from victim EOAs with unlimited approval.
Security & Exploits ·
Ekubo v2 locker suffered a $1.38M exploit on May 5, 2026, stemming from a missing access control vulnerability in its payment callback mechanism. The flaw allowed an attacker to forge fund transfers from victim externally owned accounts by manipulating the from address embedded in the locker's packed instruction payload, which the contract accepted directly from user-supplied calldata without validation.
The attacker executed a repeated sequence of operations via Core.lock calls, each combining a forward of WBTC, a withdrawal to the attacker's EOA, and a payment instruction that specified a victim's address as the transfer source. Because the victim EOA maintained unlimited WBTC approval to the router, each iteration successfully transferred tokens from the victim's balance, allowing the attacker to drain funds while maintaining debt balance within the locked position.
The transaction is recorded on-chain, with one drained account visible on Etherscan. It remains unclear whether the protocol has deployed a fix or whether additional funds remain at risk under the same conditions.