Daily Brief

Web3 Daily Exploits — 27 Oct 2026: Avalanche Safe ~$7.45M MEV Frontrun on Leftover Approvals

Avalanche 2-of-7 Safe lost ~$7.45M after unlimited approvals to an empty CreateCall-derived address were exploited; an MEV bot front-ran the sweeper and is negotiating a ~$371K WAVAX bounty. Live loss ~$7.45M, 1 incident, AVAX. X100 Tornado activity and an unverified CertiK ~$1.58M report noted.

Jacobo Avariento

Jacobo Avariento

— 11 min read
Web3 Daily Exploits — 27 Oct 2026: Avalanche Safe ~$7.45M MEV Frontrun on Leftover Approvals

The 27 Oct America/Panama window records one first-report protocol-adjacent incident used for scoring. A 2-of-7 Safe multisig on Avalanche holding trading inventory lost approximately $7.45 million after unlimited token approvals left open since March 2026 to an empty address were exploited. An MEV bot copied the sweeper transaction in the same block and took the funds; the original attacker transaction reverted. The bot has posted on-chain messages claiming whitehat status and is negotiating a 5–10 percent bounty, with one owner message offering 42,500 WAVAX (about $371 thousand). Combined live loss on this card is approximately $7.45 million pending recovery. No other first-report smart-contract exploits with fresh scored loss figures were posted by the required monitors. The prior X100 flash-loan governance incident remains an UPDATE. An unverified CertiK report of ~$1.58 million from unknown victims and a SlowMist customer-service malware note are retained without scoring.

Avalanche Safe Multisig — Avalanche — about $7.45M — Leftover unlimited approvals to empty CreateCall address / MEV front-run

What happened: DefimonAlerts reported that a 2-of-7 Safe holding trading inventory had set unlimited approvals for WAVAX, USDC, WETH.e and BTC.b to address 0x3725bd4d175283108156c3f15f86e1c51266155d in a batch transaction on 2026-03-07 16:10 UTC. On Base, Arbitrum and Ethereum the operator’s pool contract resides at that address; on Avalanche the address was empty. The address corresponds to the 13th deployment that Safe’s public CreateCall contract would produce, and CreateCall had never been used on Avalanche. The approvals were never revoked. A fresh EOA deployed CreateCall through the Safe singleton factory, performed 12 throwaway deployments, then placed a sweeper contract at 0x3725bd4d175283108156c3f15f86e1c51266155d that pulled the balances. An MEV bot copied the transaction and front-ran it in the same block, taking 3.09 million USDC, 350.4 thousand WAVAX, 182 WETH.e and 10.79 BTC.b. The original attack transaction reverted. The bot has messaged on-chain that it is a whitehat and will return the funds for a 5–10 percent bounty. The funds sit at 0x11eb9b677510e2594857f4d137fd12a7fef39bc5. Defimon detected the activity on 26 Oct at 13:00:23 UTC; the public alert and on-chain negotiation posts appeared on 27 Oct. The same operator evacuated Safes on HyperEVM, Base, Robinhood Chain, BSC and Ethereum into a fresh address holding about $38.7 million. Primary alert: https://x.com/DefimonAlerts/status/2115005055619260758.

Protocol / chain / asset: Operator-controlled 2-of-7 Safe multisig on Avalanche C-Chain. Assets drained: USDC, WAVAX, WETH.e and BTC.b held as trading inventory. The empty address that received the approvals was the deterministic output of Safe CreateCall’s 13th deployment on the chain.

Loss: Approximately $7.45 million at the time of the drain according to DefimonAlerts (3.09M USDC + 350.4K WAVAX + 182 WETH.e + 10.79 BTC.b). The MEV bot currently holds the tokens. A subsequent on-chain message offered a bounty of 42,500 WAVAX (about $371 thousand). No independent loss figure contradicting the $7.45 million total was located at cutoff. The amount is scored as the live loss pending confirmed recovery.

Attack type: Misconfiguration of unlimited token approvals left open to a deterministic empty address that any party could claim by deploying CreateCall the required number of times. Not a classic reentrancy, oracle manipulation, or private-key compromise of the Safe signers. The MEV bot’s front-run converted the attack into an intercepted drain; the bot has claimed whitehat intent and is negotiating return.

Explorer URLs: Original (reverted) attack transaction: https://snowscan.xyz/tx/0xf1f87d370290afe269ae8eb30fe8e5e4694ad153914a2de6d980641f4a331289. Bounty-related transaction: https://snowscan.xyz/tx/0xd2916fecdf3f0749692830918bd0ac8059c4d87e62d174181e609a7076911afc. Approval target / sweeper address: https://snowscan.xyz/address/0x3725bd4d175283108156c3f15f86e1c51266155d. Funds holder: https://snowscan.xyz/address/0x11eb9b677510e2594857f4d137fd12a7fef39bc5. Avalanche explorer: https://snowscan.xyz/.

Status: Activity detected 26 Oct 2026 ~13:00 UTC. Public alert and on-chain whitehat negotiation messages posted 27 Oct. Funds remain with the MEV bot pending bounty agreement and return. Operators of the related multi-chain Safes moved remaining inventory to a fresh address. No official project post-mortem located in monitored channels at cutoff. Users and operators should treat any unofficial recovery claims with caution and verify addresses independently.

Sources: https://x.com/DefimonAlerts/status/2115005055619260758; on-chain messages referenced in the same thread including https://x.com/DefimonAlerts/status/2115015351645683786.

Also noted

  • CertiK ~$1.58M unknown-victim drain to Tornado (unverified, not scored): CertiKAlert reported multiple Tornado Cash deposits tracing to 0x933e52ad61177c66db35cde3a74ab975df19204b that recently drained approximately $1.58 million from unknown victim(s). No protocol identification, no independent confirmation from other required monitors, and no loss figure beyond the CertiK statement were located at cutoff. Flagged only; not included in the scored total. https://x.com/CertiKAlert/status/2114921508657397986. Address: https://etherscan.io/address/0x933e52ad61177c66db35cde3a74ab975df19204b.
  • X100 flash-loan governance capture (UPDATE, not re-scored): The ~$4.85 million USDT drain via Senate majority capture on Ethereum remains on the 25 Oct brief. CertiK and PeckShield noted further Tornado Cash deposits by addresses associated with the exploiter (one report cited 300 ETH / ~$690 thousand already sent; another cited 821.2 ETH / ~$1.89 million). No material new loss figures used for scoring today. https://www.rektradar.xyz/web3-daily-exploits-25-oct-2026-x100-4-85m-flash-gov-yape-22k/.
  • SlowMist Udesk customer-service malware (not scored): SlowMist reported malicious JavaScript loaded via the Udesk customer-service system that collects cookies, storage and form data and replaces displayed deposit addresses / clipboard contents. No specific on-chain loss figure attached. https://x.com/SlowMist_Team/status/2115033345675678012.
  • Prior items (not re-scored): Yapeswap zero-quorum, Initia MoveVM cache, WAX bridge, NEM LP burn and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
  • Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol exploits with fresh scored loss figures beyond the Avalanche Safe detection.

Sources and references

Editor’s note: the scored live loss on this card is approximately $7.45 million, driven by the Avalanche Safe leftover-approval drain that was front-run by an MEV bot now negotiating a bounty. The incident was first publicly detailed by DefimonAlerts in the last 24 hours. The CertiK ~$1.58 million unknown-victim report is flagged without scoring. X100 remains an UPDATE from the prior window and is not re-scored. No how-to or exploit reproduction steps. Stay tuned or stay rekt.

Read more

Web3 Daily Exploits — 24 Oct 2026: Initia ~$2.7M MoveVM Script Cache Unbacked Mint

Web3 Daily Exploits — 24 Oct 2026: Initia ~$2.7M MoveVM Script Cache Unbacked Mint

Initia L1 and rollups halted after a MoveVM script-caching bug let an attacker spoof VM state and credit unbacked WETH, iUSD and USDC without changing total supplies. ~$2.7M bridged out via LayerZero and CCTP before pause; swapped to 1,135.52 ETH on Ethereum. Official confirmation 24 Oct. Live loss ~$2.7M, 1 incident, 2 chains. Kimchi Solana KOL note and DarkSword iOS alert as UPDATE.

By Jacobo Avariento