Swap0x Hack

Swap0x is a small swap contract that was deployed on Ethereum in January 2023, with no known team or website behind it. It let users trade tokens through the 0x exchange, and around 200 wallets used it, mostly between January and April 2023. To trade, users approved it to spend their tokens, mainly USDC and DAI.

The contract passes any instruction it is given to any other contract without checking it. This means anyone can tell it to move tokens out of a wallet that approved it. Attackers started doing this on 31 August 2023. Since then, more than 30 different attackers and bots have taken about $102k from 186 wallets in over 200 transactions. The largest single theft was about $22k in January 2025.

The contract cannot be paused or upgraded, so the flaw will never be fixed. If you ever used Swap0x, revoke your approvals for this contract now.

受影响的用户只要没有撤销他们的授权，就仍处于风险之中。因此我们建议您使用下方的 Revoke.cash 漏洞检查器，以确保您的安全。