Security Incident · ETH Ecosystem
Squid Multicall Approval Exploit: $517.00K Reported Loss
A user mistakenly approved the SquidMulticall contract (instead of the intended Squid Router contract) with unlimited token allowances.
- Reported loss
- $ 517,000
- Attack category
- Approval Exploit
Incident Overview
An attacker then called the permissionless run() function on SquidMulticall with crafted calldata to execute transferFrom() from the victim’s approved tokens across multiple chains (ETH, BSC, Arbitrum, Avalanche, etc.). This drained approximately $517K.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.