Coinbase error triggers $300K exploit via 0xProject swapper contract
Coinbase has confirmed it lost about $300,000 in accumulated fees to a MEV (Maximal Extractable Value) bot after mistakenly interacting with the 0xProject swapper smart contract.
Security researcher “deebeez” revealed that the 0xProject contract is permissionless, meaning anyone can execute actions without restrictions—making it unsafe for receiving token approvals, reports Cryptopolitan.
Coinbase reportedly initiated approvals for multiple protocols’ tokens, which enabled the MEV bot to drain the funds immediately after approval. The exchange’s Chief Security Officer Philip Martin acknowledged the incident, calling it an isolated issue tied to changes in one of Coinbase’s corporate DEX wallets and stressing that no customer funds were impacted.
Community and security expert reactions
Critics called the mistake concerning for a leading U.S. exchange, particularly after Coinbase disclosed a separate cyberattack with potential $400 million losses earlier this year. Some suggested encrypted mempools could help prevent such exploits, though deebeez clarified that MEV and sandwich attacks differ and encryption would not have stopped this case. The event also revived scrutiny of Coinbase’s recent listing decisions, including adding the Solana memecoin USELESS, and technical outages reported by some users.
Composability risks and precedent incidents
The exploit highlights a broader composability risk in DeFi, where individually secure systems can become vulnerable when combined. This is not the first such case involving 0xProject contracts. In April, Zora’s claim contract accidentally sent tokens to the 0x settler contract during an airdrop, allowing attackers to claim and sell $128,000 worth of tokens. Security firm BlockAid labeled this a “Composability Attack,” underscoring how interaction between different protocols can create exploitable situations even without a direct vulnerability in the code.
Recently we wrote that despite a sharp 370% rally in the past 24 hours to $88, fake Coinbase (COIN) token is being flagged by analysts as a high-risk and deceptive investment that could leave traders with significant losses.
Latest Coinbase News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
