The error occurred after a wallet interacted with a contract not intended to receive token approvals
Coinbase has confirmed it lost roughly $300,000 in tokens after mistakenly granting approvals to a 0x Project smart contract known as the “swapper.” The incident, first flagged by Venn Network security researcher Deebeez, occurred when the exchange’s corporate wallet interacted with the contract, which is designed for executing swaps but is not intended to receive token approvals. Because the swapper contract is permissionless, anyone can trigger it to perform arbitrary actions, making approved assets immediately vulnerable.
According to Deebeez, Coinbase’s fee receiver account approved tokens such as Amp, MyOneProtocol, DEXTools, and Swell Network for the swapper contract on Wednesday afternoon. Shortly after, a maximal extractable value (MEV) bot, which had apparently been monitoring for such approvals, called the contract to transfer the tokens into its own addresses. The researcher described the bot as “lurking” until an opportunity like this arose.
Deebeez noted that the same swapper setup has been linked to previous losses in unrelated cases, including issues with Zora claims on Base. In this incident, Coinbase’s fee receiver account was completely drained of its tokens, which he called a costly operational error.
Philip Martin, Coinbase’s chief security officer, confirmed the error and described it as an isolated issue stemming from a configuration change in one of the exchange’s corporate decentralized exchange wallets. He stressed that no customer assets were at risk and that Coinbase acted quickly to revoke token allowances and move remaining funds to a new wallet.
The loss adds to a series of MEV-related incidents in the crypto space. Earlier this year, a vulnerability in an MEV bot’s access control system cost it $180,000 in Ether, and in 2023, a rogue validator stole $25 million from MEV bots using “sandwich trade” tactics. In Coinbase’s case, the takeaway appears to be that even routine wallet interactions can become high-risk if permissions are misapplied.
