Rabby Swap Hack

Rabby is a multi-chain crypto wallet made by the team behind DeBank. On 14 September 2022, Rabby launched a Swap feature that let users trade tokens right inside the wallet, which meant approving Rabby's swap contract to spend their tokens. About a month later, on 11 October 2022, an attacker found that this contract would carry out whatever instructions a caller gave it without checking them. They used it to tell token contracts to send them the tokens that users had approved to Rabby Swap.

The attacker took 114 ETH and 179 BNB, worth about $200k, from wallets on Ethereum and BNB Chain, and sent the funds through the Tornado Cash mixer. Rabby quickly warned that anyone who had used Swap should revoke their approvals on all chains, while wallets that had never used it were not affected. The contract had been audited by the security firm PeckShield, but the flaw was missed. Rabby reimbursed affected users from its insurance fund.

The same vulnerable swap contract was deployed on 19 chains, and it cannot be changed. It was never paused or patched, so approvals given to it stay dangerous for as long as they are active, and any wallet that still has one remains at risk. If you used Rabby Swap in 2022 on any chain, check your wallet and revoke your approvals to the old Rabby swap contract. Revoking protects the tokens that are still in your wallet, but it does not recover funds that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.