Coinbase loses $300k to rogue MEV bots after token swap misconfiguration blunder

Coinbase, the largest US-based exchange, has reportedly mislaid $300,000 to MEV bots pursuing a misconfiguration involving 0xProject’s token swap platform.

On Aug. 13, pseudonymous information researcher Deebeez revealed that Coinbase mistakenly utilized the 0x swapper to o.k. tokens, a relation it was ne'er designed for.

He noted:

“0x has a swapper which is ne'er meant to get approvals This aforesaid swapper is known to person had issues with Zora claims connected Base, since it allows users to person it marque arbitrary calls.”

According to him, this support granted unlimited entree to the tokens accrued arsenic fees successful the exchange’s router, creating an opening for exploitation.

MEV Bots Drain Coinbase (Source: X/Deebeez)

As a effect of this oversight, the MEV bots drained Coinbase’s interest receiver relationship of each accumulated tokens.

He added:

“There appears to person been an MEV bot lurking successful the dark, waiting for users to mistakenly o.k. to this declaration – and past drain each their funds. Well, their imagination came existent acknowledgment to Coinbase.”

Coinbase’s response

Coinbase Chief Security Officer Philip Martin confirmed the breach was an isolated event.

According to Martin, the incidental stemmed from a caller alteration to 1 of the company’s firm decentralized speech (DEX) wallets, which led to unauthorized token transfers.

Meanwhile, helium stressed that the incidental impacted nary lawsuit assets.

Martins added that the speech has since revoked token allowances and moved its holdings to a caller firm wallet to forestall further losses.

This information incidental follows an insider-driven information breach that exposed the personal accusation of astir 70,000 users.

Coinbase reported that the perpetrators attempted to extort $20 million successful Bitcoin. They besides utilized the stolen information to impersonate institution unit successful sophisticated societal engineering schemes, which reportedly led to the theft of millions of dollars.

Since then, Coinbase said it has strengthened its information protocols to forestall aboriginal attacks and terminated the employees implicated successful the breach.

The station Coinbase loses $300k to rogue MEV bots aft token swap misconfiguration blunder appeared archetypal connected CryptoSlate.