Unibot Hack

Unibot is an automated trading bot that lets users buy and sell tokens on Ethereum directly from Telegram. On 28 October 2023, it released a new router contract, the smart contract that carries out users' trades, and users who traded through it approved it to spend their tokens. The new router had a serious flaw: it would pass on any instructions it was given without checking who was asking or where they were going. On 31 October 2023, an attacker used this to make the router transfer tokens out of wallets that had approved it.

The attack ran for about nine hours and drained around $640k worth of tokens before Unibot halted trading through the router. The attacker sold the stolen tokens and laundered 354 ETH through the Tornado Cash mixer. Unibot then revoked the risky approvals on users' behalf, even sending ETH to wallets that lacked gas so the revocations could go through. It refunded affected users out of its own funds, mostly by buying back the lost tokens, at a total cost of about $1.78M.

Unibot never repaired this router, it simply stopped using it, so the contract is still vulnerable and any approval that is still active can be abused. If you traded with Unibot around the end of October 2023, check your wallet for approvals to this router and revoke them. According to Unibot, the attack only affected tokens approved to this specific router, and ETH balances were not touched.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.