An unnamed decentralized exchange router on BNB Chain was exploited for approximately 62.28 WBNB after attackers abused previously granted token approvals across multiple wallets. The exploit affected 29 addresses in a single transaction and resulted in losses of roughly $46,000, according to SlowMist’s security incident database.
The incident centered on the router at 0xa331fde028e6F17425AB9333c39ae43722340d24 and transaction 0x40eb22369da422a8275d5679054aa3a8c8906d93abc0bac3a3f2cad879389319. The vulnerability allowed the attacker to exploit existing ERC-20 allowances without compromising victims’ private keys, turning permissions previously granted to the router into the mechanism for draining funds.
Fake Pool Exploits Swap Callback
The root cause was an authentication failure involving the router’s uniswapV3SwapCallback function. SlowMist said the contract did not properly verify that callbacks originated from a legitimate V3 liquidity pool. The attacker could therefore deploy a fraudulent pool, designate victim wallets as payers and trigger unauthorized transferFrom() calls against their existing allowances.
Technical analysis of the transaction indicates the attacker used a flash swap before executing the approval drain and liquidating the extracted tokens through available AMM liquidity. The attack required little upfront capital because the vulnerable callback path provided access to funds already authorized for spending by the affected wallets.
The reported attacker address was 0xB929C7215c0ec8EbAD5fBf73b1Da63bccfFf1896. After completing the exploit and repaying the flash liquidity, analysis placed the attacker’s net proceeds at approximately 62.28 BNB. The entire extraction occurred within the focal transaction, making the exploit a rapid approval-drain rather than a prolonged compromise of user accounts.
Existing Token Approvals Remain the Main Risk
The incident illustrates the security consequences of unlimited or persistent ERC-20 approvals. Users commonly authorize routers to spend tokens so future swaps can execute without repeated approvals, but a vulnerability in an approved contract can transform those permissions into a direct path to user assets.
Security researchers have advised anyone who previously interacted with the affected router to inspect and revoke outstanding approvals. Removing unused allowances can prevent the compromised router from accessing additional tokens if the vulnerable execution path remains available.
SlowMist classifies the incident as a smart-contract vulnerability rather than a private-key compromise, administrative takeover or price-manipulation attack. The failure was fundamentally an access-control problem inside the swap callback, where attacker-controlled inputs were trusted without sufficient verification of the calling pool.
The router’s development team has not publicly issued a post-mortem or recovery plan. Until further mitigation is confirmed, the clearest operational response for previous users is to review existing token approvals tied to the affected contract, while the stolen funds themselves have already moved under attacker control.