Hacker Steals $1.4 Million Through Vulnerability in Ekubo Contract

The Ekubo DeFi protocol has suffered a significant security breach involving its token swap contract on Ethereum and other EVM networks, with losses estimated at $1.4 million, according to project developers.

In a statement, Ekubo reported an active security incident but reassured users that liquidity providers were not affected, and the Starknet version of the protocol remained secure. Users were advised to revoke any active token approvals to prevent further risk.

Blockaid, a blockchain security firm, identified that the exploit originated from a flaw in a custom extension of the Ekubo contract, which allowed the hacker to manipulate transaction details without proper validation. Specifically, the attacker was able to substitute their own values in requests, including who pays and the amounts involved.

Following an investigation, it was revealed that due to a previously granted unlimited approval by one user, the hacker executed 85 transactions, draining 17 wrapped Bitcoin (WBTC) from the contract. These funds were subsequently sent to the Velora exchange, where they were converted into USDC, DAI, and ETH before being laundered through Tornado Cash.

On-chain analyst Darkfost pointed out that the attack exploited the callback mechanism in the extension, enabling the hacker to act as if they were the authorized spender of the victim's tokens. This incident marks a growing concern in the DeFi sector, which experienced a record number of attacks in April 2026, with over 20 reported incidents.