Ekubo Protocol Attacked: $1.4 Million Stolen via Contract Flaw

The Ekubo Protocol, a prominent decentralized exchange (DEX) infrastructure provider, has suffered a security breach resulting in the theft of approximately $1.4 million. According to real-time monitoring by the cybersecurity firm Blockaid, the incident occurred in the early hours of May 6, 2026. The attack targeted a custom extension contract on the Ethereum blockchain, exploiting a specific logic vulnerability within the protocol's callback mechanism. While the core protocol remains functional, specific groups of users who interacted with legacy versions of the system are urged to take immediate action.

Mechanism of the Extension Contract Exploit

The security breach was traced back to the IPayer.pay callback function within an Ekubo extension contract. Security researchers identified that the contract failed to properly validate the parameters for the token.transferFrom operation. Specifically, the payer, token, and amount variables were pulled directly from a "locked payload" that could be manipulated by an external actor.

• The attacker exploited the lack of checks to see if the payer was the legitimate initiator of the lock or an authorized party.
• By routing through the Core lock to the extension contract, the exploiter could designate any authorized user as the payer.
• Assets were then redirected to the attacker's own address, serving as the withdrawal recipient.

This type of logic error highlights the risks associated with modular DeFi architectures where custom extensions may not inherit the same rigorous security checks as the core protocol.

Impacted Users and Risk Mitigation

Despite the scale of the theft, the Ekubo team and Blockaid have clarified that the majority of current users are unaffected. The risk is strictly limited to individuals who have previously granted ERC-20 token authorizations to the protocol's V2 contract as a spender. Because these approvals remain active on-chain, the attacker was able to trigger transfers from these specific accounts using the vulnerable extension.

"Ekubo users themselves are unaffected, and only users who authorized the V2 contract as a token spender are at risk", Blockaid noted in its initial assessment.

The protocol is reportedly preparing a comprehensive post-incident analysis to detail the recovery steps. In the meantime, security experts recommend that any Ethereum users who have interacted with Ekubo V2 in the past should immediately revoke their token allowances using tools like Revoke.cash or Etherscan to prevent further unauthorized withdrawals.

The incident underscores a recurring theme in 2026, where even established protocols on Ethereum and Starknet face challenges from legacy contract vulnerabilities. As of the time of publication, the Ekubo Protocol team is working to secure the remaining extension points to prevent similar exploits across its Arbitrum and Ethereum deployments.