Magpie Hack

Magpie was a cross-chain DEX aggregator that helped users swap tokens across many blockchains in one step, and it rebranded to Fly in May 2025. Its router contracts were built to be flexible, but they had a safety check that should have stopped anyone from moving tokens out of other users' wallets. On 23 April 2024, an attacker found a gap in this check. Using a specially crafted wallet address, they disguised a transfer command so the router accepted it, letting them take tokens from wallets that had approved the router.

About $130k was stolen. The affected routers were deployed on Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche, Base, zkSync, Polygon zkEVM, Blast and Manta, and Magpie asked everyone to revoke their approvals on all of them. It then stopped the attack by switching off every allowed command on the routers, which effectively shut them down. Security researchers, including SEAL 911, helped confirm the issue and the fix. Magpie reimbursed affected users in full, returning the same asset they lost on the same chain.

The old Magpie routers were not put back into service after the attack. They were shut down and have since been replaced by newer Fly routers, and Magpie promised an audit before releasing a new version. Because the old routers are no longer used, there is no reason to keep approvals to them, and revoking removes any remaining risk. If you still have approvals to these contracts on any chain, revoke them.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.