Hashflow Hack

Hashflow is a decentralized exchange for swapping tokens. Before this incident, it had moved to new smart contracts and stopped using its old ones, but many users never removed the approvals they had given to those old contracts. On 14 June 2023, it became clear that the retired contracts had a flaw that let anyone move approved tokens out of users' wallets. The old contracts had been deployed on Ethereum, Arbitrum, Avalanche, BNB Chain and Polygon, and all of these chains were affected.

A whitehat hacker used the flaw first, moving over $600k from exposed wallets into a recovery contract so that owners could take it back. Owners could claim their full balance or choose to leave 10% as a tip for the whitehat. Hashflow backed this recovery, said its current exchange was not affected and promised that all affected users would be made whole. Even so, blackhat hackers later used the same flaw to take about $40k from wallets that still had approvals in place.

The retired contracts remain vulnerable today. If you ever used Hashflow before it switched contracts, check for approvals to the old contracts on every chain listed here and revoke them. If you still have rescued funds waiting to be claimed, revoke your approvals first and claim afterwards, so the returned tokens cannot be taken again. Revoking protects what is still in your wallet, but it does not undo thefts that already happened.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.