Zapper Hack

Zapper is a popular DeFi dashboard app. In 2021 it offered a Polygon Bridge feature that let users swap tokens and move them from Ethereum to Polygon in one step, and people approved the bridge contract to spend their tokens. When Zapper replaced it with a new version, the old contract stayed on Ethereum with many approvals still active. It turned out that the old contract would carry out any instructions it was given, so anyone could make it move tokens out of wallets that had approved it.

After whitehat researchers reported the flaw, Zapper used it on 13 June 2021 to move the funds at risk to safety, because the contract had no proper pause switch. A bot copied Zapper's very first rescue transaction 25 seconds later and grabbed a further $465k, but its operator returned the funds after security researcher samczsun got in touch. Zapper reimbursed affected users, who could claim their funds back after revoking. However, a second bot went unnoticed and took roughly $367k over the following nineteen months, which was never returned.

Zapper also switched on the contract's stop setting, but that setting does not actually block the flaw. Wallets that still had approvals to the contract were being drained as recently as 2026. If you ever used Zapper's Polygon Bridge, check your approvals on Ethereum and revoke any that remain for this contract. Revoking protects the tokens that are still in your wallet, but it does not recover tokens that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.