Safe multisig on Avalanche exploited for $7.45M due to unlimited token approvals to an empty address; MEV bot frontran the attack and secured $3.09M, claiming whitehat status and negotiating return.
Security & Exploits ·
A Safe multisig on Avalanche lost $7.45M after approving unlimited token spending to an address that was empty on that chain, though it held legitimate pool contracts on other networks. An attacker deployed code to the address and began withdrawing funds, but an MEV bot front-ran the transaction in the same block and secured $3.09M in USDC, WAVAX, WETH.e, and BTC.b. The bot claims whitehat status and is negotiating on-chain for a 5–10% bounty to return the funds. The Safe's signers have since evacuated approximately $38.7M across multiple chains into a single address.