Dormant Approval Sparks $13.3M Ethereum Heist

by

An ancient Ethereum token approval woke from a nap and decided to sign away $13.3M faster than a goblin can say “watch your wallet.”

The wallet drama begins with a touch of bureaucratic sleepiness: a token approval, long forgotten, shrugged off its responsibilities until an attacker found it and proposed a sudden, extremely efficient heist. The funds arrived through an account abstraction transaction, and the trespasser moved with the punctuality of a clerk who actually enjoys their job.

The wallet had unknowingly granted spending rights weeks earlier, which is to say the permissions were chilling in the background like a cautious librarian who happens to own a dragon.

When the transfer landed, the dormant approval granted full access without a “are you sure?” prompt. The incident demonstrates that quiet permissions can be waiting in the wings, ready to pounce without a warning cough.

Wallet Receives Funds and Is Drained Quickly

The victim wallet, identified as 0xba15E9b644685cB845aF18a738Abd40C6Bcd78eD, received about $13.3 million in a single transaction, as if a very greedy street performer had decided to tip itself a fortune.

The attacker executed the transfer using an account abstraction mechanism designed to simplify wallet operations and apparently to confuse the moral compass of any bystander.

Blockchain records show the funds arrived and the attacker removed them within seconds. The rapid timing left no window for manual intervention or heroic but misguided attempts at stopping the tug-of-war with a broom.

The speed suggested the attacker already had access before the transfer occurred, rather than staging a bold new permission heist on the fly.

Additionally, security trackers confirmed that no new approval transactions took place during the incident. That ruled out the usual suspects like phishing or signature-based tricks, as if the power went out and no one noticed the light switch was still on.

Investigators reviewed historical onchain activity linked to the wallet. Their focus shifted to older token approvals that had never been revoked, which is to say, the past was very much still at work in the present.

This review revealed an earlier approval that still allowed third-party spending. That dormant permission became the entry point for the faux-magnificent heist.

Old Approval Enabled the Exploit

Investigators traced the root cause to an approval transaction made on January 1, 2026. That call granted spending rights to address 0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e.

At the time, the approval did not raise public concern. The permission remained active and was not revoked, which is a classic case of “we never thought to check the security policy of a sleepy device.”

An old approval just cost $13.3M.

The victim address 0xba15E9b644685cB845aF18a738Abd40C6Bcd78eD received ~$13.3M via an account abstraction transaction and was drained within seconds.

The root cause traces back to an approve() call made on Jan 1, 2026, granting spending rights…

– QuillAudits 🥷 (@QuillAudits_AI)

The attacker address, 0x6cAad74121bF602e71386505A4687f310e0D833e, later used this approval. It allowed full access to the incoming funds. Once the funds arrived, the attacker executed transfers without delay and pulled the entire balance in one coordinated move.

Fund Movements After the Drain

After the drain, the attacker swapped the stolen assets from tokens into WETH and then into ETH. These steps reduced exposure to token-level tracking, which is almost as practical as wearing sunglasses at night.

The attacker then moved funds across multiple wallets. Transfers were fast and spread across several addresses, forming a breadcrumb trail that would make even a particularly diligent goose jealous of the pattern.

This method created a complicated transaction pattern, the kind of thing attackers use to slow down tracing efforts while basking in their own cleverness.

Blockchain analysis shows a portion of the ETH remains on-chain. These funds sit in addresses still linked to the attacker, which means the trail isn’t exactly a mystery novel with a surprise ending-just a long, tedious footnote.

Related Reading: $25M in Losses: Machi Liquidated for 1,000 ETH After Market Drop

Ongoing Onchain Observations

Security observers continue monitoring the attacker-linked wallets. However, investigators found no mixing services during the initial movements, which is to say the attacker didn’t bother hiring a particularly flashy disguise this time around.

The presence of funds on-chain leaves room for tracking. Analysts rely on transaction timing and address links, which is the blockchain equivalent of following footprints in a very high-tech mud pie.

The incident shows how older approvals can remain active. Wallet owners often forget these permissions over time, which is less a security model and more a peculiar form of digital hoarding.

As of the latest data, no recovery transaction has occurred. The stolen funds remain under attacker control, enjoying the internet’s equivalent of a glamorous, unpaid vacation.

Read More

2026-01-27 10:24