Ekubo Hack

Ekubo is a decentralized exchange that began on Starknet and later expanded to Ethereum and Arbitrum. To make swaps cheaper there, it built special gas-saving routers, and users approved these routers so they could trade their tokens. Ekubo chose not to have these routers audited because it considered them low risk. On 5 May 2026, attackers found that by adding extra data to the end of a normal swap request, they could trick the routers into taking tokens from someone else's wallet. This let them spend the token approvals of anyone who had approved the routers.

Attackers took close to $1.42M in dozens of quick transactions on Ethereum, mostly in WBTC, along with smaller amounts of cbBTC, USDC and other tokens. Only a tiny amount was taken on Arbitrum. Ekubo quickly warned users to revoke their approvals, and its website stopped asking for new approvals to the affected routers. Its core contracts, liquidity providers and Starknet deployment were not affected. Ekubo published a detailed post-mortem and a reimbursement plan that proposes paying back losses in the tokens that were taken, up to a cap per address.

The affected routers cannot be changed, so they stay vulnerable for as long as approvals to them exist. Ekubo fixed the bug for future routers, and its website now warns users who still have approvals to the old ones. Anyone who approved Ekubo's routers on Ethereum or Arbitrum should revoke those approvals now, especially unlimited ones. Ekubo's reimbursement plan also asks affected users to revoke remaining unlimited approvals before they are paid. Ekubo has since proposed a standard for token approvals that expire automatically, and plans to give future routers an expiry date.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.