Avalanche Safe Stale-Approval Drain

On October 26, 2026, an Avalanche Safe multisig was drained of approximately $7.45 million after an attacker abused a token approval the wallet had granted — and never revoked — seven months earlier, though a MEV bot front-ran the theft and ultimately returned most of the assets.

What happened

The victim was a 2-of-7 Safe (0x631fca…b9b8) on Avalanche C-Chain. On March 7, 2026, the Safe had granted standing, unlimited ERC-20 allowances for WAVAX, USDC, WETH.e and BTC.b to the spender address 0x3725bd4d175283108156c3f15f86e1c51266155d. That address held an operator's pool contract on Ethereum, Base and Arbitrum — but on Avalanche it was empty. Because the approval was never revoked, anyone who could place code at that address could spend the Safe's tokens.

On October 26 the attacker did exactly that, using Safe's own CreateCall helper to deterministically deploy a sweeper contract at the approved address, then calling transferFrom to pull the balances. No signer keys were compromised and no Safe contract misbehaved — the wallet behaved exactly as configured. The basket swept came to roughly 3.08 million USDC, about 350,000 WAVAX, ~182 WETH.e and 10.8 BTC.b, totalling around $7.45 million. In a twist, the original attacker's transaction (0xf1f8…1289) reverted because a MEV bot copied the identical drain and landed first in the same block (0xf88a…7ed5), capturing the funds instead.

Aftermath

The MEV operator behaved as a de facto white hat, signalling it would return the assets for a bounty. On October 27 a Safe owner agreed on-chain to let the bot keep 42,500 WAVAX (about $371,000), and by that point all USDC, WETH.e and BTC.b plus roughly 307,800 WAVAX had been sent back, leaving only the bounty retained. The episode echoes Transit Swap, where most of a $21 million approval-drain was returned after on-chain negotiation.

Why it matters

Stale, unlimited approvals are a slow-burning liability: the danger here was created in March and detonated in October, long after anyone was watching. The same class of flaw emptied users of LI.FI and Socket, where infinite approvals turned a single contract bug into a mass drain. This case adds a sharper lesson — an approval pointing at an address that is a live contract on one chain but empty on another is a latent backdoor, because Safe's deterministic deployment let an attacker simply place code where the allowance expected it. Revoke approvals you no longer use, and never assume an unused spender address is safe just because it has no code today.