Swap0x Hack

Swap0x is a small swap contract that was deployed on Ethereum in January 2023, with no known team or website behind it. It let users trade tokens through the 0x exchange, and around 200 wallets used it, mostly between January and April 2023. To trade, users approved it to spend their tokens, mainly USDC and DAI.

The contract passes any instruction it is given to any other contract without checking it. This means anyone can tell it to move tokens out of a wallet that approved it. Attackers started doing this on 31 August 2023. Since then, more than 30 different attackers and bots have taken about $102k from 186 wallets in over 200 transactions. The largest single theft was about $22k in January 2025.

The contract cannot be paused or upgraded, so the flaw will never be fixed. If you ever used Swap0x, revoke your approvals for this contract now.

影響を受けたユーザーは、承認を取り消さない限りリスクにさらされ続けるため、以下の Revoke.cash エクスプロイトチェッカーを使用して、ご自身が安全であることを確認することをお勧めします。