Bitmor Hack

Bitmor is a Bitcoin-focused DeFi platform on Base that offers loans for buying Bitcoin. Its first DCA (dollar-cost averaging) contract let users set up plans that regularly spent USDC from their wallets to buy Bitcoin, which meant approving the contract to spend their USDC. On 25 May 2026, attackers took control of the wallet that ran these purchases for Bitmor. They used it to point the contract at a malicious contract of their own instead of the Uniswap exchange it normally traded through.

The malicious contract then pulled USDC straight out of the wallets of users with active DCA plans, taking about $7k in total, all on Base. Most of it was taken within about two hours, and a second wave that evening drained wallets that had not revoked yet. Bitmor said the attacker was a known exploiter who had already been flagged on Base. The team told users to revoke their approvals immediately, so that any USDC arriving in their wallets later could not be drained as well, and to withdraw any cbBTC, Coinbase's wrapped version of Bitcoin, that they still held on the platform.

The attack was caused by a stolen admin key rather than anything users did wrong, but it still depends on their approvals. Any wallet that still has a USDC approval to Bitmor's first DCA contract remains at risk, including USDC that arrives in the wallet later. If you ever set up a DCA plan on Bitmor, revoke that approval now. Revoking protects the funds you still have, but it does not recover USDC that was already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.