Crypto permissions granted to a contract remain active until you remove them. Starting May 5, 2026, attackers exploited this rule. They took approximately $1.42 million from 31 addresses, using permissions given to an Ekubo protocol router. The main victim had granted his 158 days earlier, according to the founder of SlowMist.
In brief
- $1.42 million: Attackers took this amount starting May 5, 2026, with permissions granted to an Ekubo router.
- 158 days: this is the age of unlimited authorization which cost the main victim approximately 17 WBTC.
- 60%: this is the share of unlimited authorizations on Ethereum, according to a 2022 study covering transactions until July 2021.
- May 6, 2026: The day after the first drawdown, the founder of Ekubo proposed ERC-8255, permissions that expire by default.
A crypto authorization does not end with the transaction
To exchange a token on a decentralized application, you first sign an authorization. This message allows a contract to collect your tokens for you. The ERC-20 standard provides that it can do this “several times, up to the amount” fixed. However, your wallet does not always display what you sign, as shown in our article on clear signing.
Above all, this authorization has no end date. THE official ethereum.org guide to revocation says it bluntly: “There is no expiration date on contract permissions. » They can therefore be used years later.
Disconnecting from the site doesn’t change anything either. The authorization is in the token contract, on the blockchain, not in your browser. According to the same guide, the project therefore retains access to your tokens after disconnection. Your digital wallet actually stores your keys, not your authorizations. You must then withdraw the authorization to cut off this access.
The amount then poses a second problem. Many applications require unlimited access, so as not to ask for it again each time you exchange. An academic study published in 2022 measured it on transactions made through July 31, 2021. At the time, 60% of authorizations on Ethereum were for an unlimited amount.
Crypto permissions: what you think you accept
When you validate an exchange, you think you are authorizing this single transaction. In reality, authorization goes further. It allows the contract to take an amount of token, at any time, until it is withdrawn.
As long as the contract works well, it only charges for your own operations. On the other hand, a flaw in its code could allow a third party to trigger the debit. Authorization does not check who calls the contract. It only checks that the contract has the right to take your tokens.
Ekubo has also revised his own explanation. On May 8, his report probably attributed the large authorizations to users who would have raised the ceiling themselves. On May 16, the text changed. The team indicates that its interface may have created some of these permissions, and is no longer seeking to attribute the origin.
Ekubo: how a forgotten router emptied wallets
Ekubo is an exchange protocol present on Starknet and on several blockchains compatible with Ethereum. The attack targeted HuffRouter, a router optimized to reduce fees, deployed on Ethereum and Arbitrum. Its users had in fact given it the right to collect their tokens to execute their exchanges.
A call data analysis bug in HuffRouter […] allowed a caller to add arbitrary bytes after an otherwise valid exchange path, and have them interpreted as data set by the router during settlement.
Ekubo, incident report
Concretely, the attacker could designate any user as payer of an exchange. Anyone who had authorized this router thus became a target. The first sample was taken on May 5, 2026, at 5:50 p.m. UTC.
Ekubo estimates losses at around $1.42 million, across 31 addresses. A single address, however, lost around 17 WBTC, or almost $1.37 million, as well as 0.34 cbBTC. It therefore accounts for 98% of the total. The attack did not affect liquidity providers or the Starknet version of the protocol.
The team also acknowledges that it did not have this contract audited. She considered her risk low. According to her, authorizations could be limited, and exchanges via the interface should remain small and rare. These routers can no longer be modified: they “remain vulnerable”, specifies the report. Ekubo then deployed a reimbursement fund on June 23, capped by address and paid voluntarily by its DAO.
Socket, LI.FI, SwapNet: the same pattern for years
Ekubo is not an isolated case. The Revoke.cash site lists these attacks in its annual report. It has 9 authorization operations in 2025, for a little more than 6 million dollars. In 2024, they had cost 80 million.
In July 2024, the LI.FI platform lost around $11.6 million, taken from 153 wallets. According to the report published by LI.FI, the flaw only affected unlimited authorizations. In January 2024, a near breach at Socket targeted around 200 users, all with unlimited access.
As of January 2026, 18 users lost $13.43 million through SwapNet contracts. According to the post-mortem of the Matcha Meta platform, the victims had deactivated the single-use authorization offered by default. Matcha points out, however, that a specific amount never used also left the funds exposed.
However, these attacks differ from signature scams. In this case, a fake site makes you sign an authorization for the benefit of the scammer. This type of theft cost $83.85 million in 2025, according to the 2025 report from security company ScamSniffer.
Reduce the risk of crypto permissions
The first instinct is to limit the amount. MetaMask allows you to set a spending limit when signing. His official support is clear: “Never grant unlimited (astronomically high) permissions. »
Then, clean regularly. The tool Revoke.cash displays your crypto permissions on 80+ networks. The Etherscan Explorer checker does the same on Ethereum. Removing one permission at a time is free, excluding network fees. Revoke.cash, on the other hand, charges $1.50 per bulk withdrawal. In a January 2024 advisory, the Singapore Police Force and Cybersecurity Agency also recommended reviewing and removing elevated permissions.
Finally, some applications already limit the duration. The Uniswap app goes through Permit2 and grants 30-day permissions, according to its help center. However, you give an initial authorization to the Permit2 contract itself, and this does not expire. On Starknet, tokens also follow the same model as Ethereum, without expiration.
ERC-8255 wants to expire default permissions
On May 6, 2026, Moody Salem, founder of Ekubo, submitted the project ERC-8255 on the EIP website. Its principle is simple: a classic authorization would expire after a maximum duration, set by each token. A new function would also allow a shorter authorization to be granted, up to a single block.
The text first adds new functions, compatible with existing applications. However, it changes the behavior of ordinary permissions, which divides developers. On the Ethereum Magicians forum, some prefer to leave classic authorization intact. The researcher pcaversaccio judges on the contrary that “permissions have always been a bug, not a feature” (editor’s translation).
Other avenues also exist. Proposal ERC-7674 provides for permissions to be cleared at the end of the transaction. Since the Pectra update of May 2025, a compatible wallet can also combine authorization and exchange in a single operation.
As of October 18, 2026, ERC-8255 remained a draft, and its text did not reference any implementations. Ekubo routers affected on May 5 cannot be modified. Their unlimited authorizations therefore only disappear if each user withdraws them. Our comparison of the most secure crypto wallets presents the other protections available.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
