The Payer Callback Peril: How an Access-Control Flaw in Ekubo EVM Router Siphoned 1.4 Million

The decentralized finance ecosystem faces a renewed crisis as the Ekubo Protocol, a prominent decentralized exchange (DEX) primarily known for its Starknet deployment, suffered a devastating 1.4 million drain of Wrapped Bitcoin (WBTC) through its EVM-compatible swap router. The exploit, which occurred between May 5 and May 6, 2026, targeted a critical access-control vulnerability in the protocol’s v2 EVM extension contracts, specifically weaponizing persistent token approvals to siphon assets directly from user wallets. This incident, occurring in the shadow of a record-breaking April that saw over 625 million in DeFi losses, highlights a systemic failure in how modern protocols handle external callbacks and the ongoing danger of unlimited token permissions.

By Elena Kowalski | May 15, 2026

As of today, May 15, 2026, the market remains on high alert. Bitcoin is currently trading at 80,651 USD, while Ethereum holds at 2,256.27 USD. Notably, Wrapped Bitcoin (WBTC), the primary asset targeted in the recent wave of exploits, is priced at 80,329 USD. These valuations underscore the significant financial impact of the 17 WBTC stolen during the Ekubo breach, as the theft occurred during a period of high market liquidity and volatility.

The Exploit Mechanics: The IPayer.pay Callback Flaw

The technical core of the Ekubo Protocol exploit lies in an access-control failure within the protocol’s EVM v2 swap router. Unlike the core Starknet deployment, which utilizes a different architectural model, the EVM extension was designed to facilitate cross-chain or EVM-native swaps. The vulnerability was located within the IPayer.pay callback mechanism, a standard pattern used in many DeFi protocols to allow a contract to request funds from an external “payer” during a multi-step transaction.

In a secure implementation, a callback should strictly verify that the entity initiating the payment has the authority to do so or that the payment is part of a validated, internal state transition. However, in the case of Ekubo’s EVM router, the IPayer.pay function allowed an external caller—in this case, the attacker—to specify the payer, the token, and the amount without any validation of the caller’s identity or intent. By providing malicious data to the router, the attacker was able to force the contract to invoke the transferFrom function on any address that had previously granted a token approval to the router contract.

The attack was executed with clinical precision. The exploiter deployed a custom contract that repeatedly called the vulnerable router, chaining approximately 85 rapid transactions. Each transaction identified a different “payer” from a list of users who had interacted with the router and granted it unlimited WBTC approvals. Because the router was a trusted entity to the WBTC contract, it successfully siphoned the funds. Once the 17 WBTC were secured, the attacker immediately converted the stolen assets into WETH and DAI on-chain to obfuscate the trail and prevent centralized freezing of the assets. The total loss is estimated at 1.4 million based on current market rates.

Affected Systems: The Danger of Persistent Approvals

The Ekubo Protocol exploit was strictly limited to the EVM deployment on Ethereum and Arbitrum. The protocol’s primary Starknet deployment, which manages the vast majority of its liquidity, was not affected. This distinction is due to the fundamental differences in how Starknet handles account abstraction and contract interactions compared to the Ethereum Virtual Machine (EVM).

The users at risk were those who had granted persistent token approvals to the Ekubo EVM v2 router. In the DeFi ecosystem, it is common practice for decentralized applications (dApps) to request “infinite” approvals to save users gas. While convenient, this practice creates a permanent backdoor. If the approved contract contains a vulnerability—such as the IPayer.pay flaw—an attacker can bypass the user’s private keys and move funds through the vulnerable proxy.

This incident follows the TrustedVolumes breach, a market maker associated with the 1inch Network, which suffered a 6.7 million loss earlier this month. In that case, a custom RFQ swap proxy was targeted. These events suggest a pattern where attackers prioritize direct asset siphoning via access-control failures in auxiliary router contracts over more complex economic exploits.

The Mitigation Strategy: Beyond the Emergency Revoke

Immediately following the detection of the exploit, the Ekubo team issued an urgent warning to revoke approvals. Because the contracts were immutable, the team could not “patch” the code directly. The only viable defense was for individual users to sever the link using tools like Revoke.cash or Etherscan’s Token Approval checker.

Industry experts are now advocating for approval expiration or limited-time permissions. If a token approval were to expire automatically, the window for an attacker to weaponize a “stale” approval would be drastically reduced. Furthermore, protocols should prioritize strict access control on all callback functions, ensuring that callbacks can only be triggered by the contract itself during a specific execution flow.

• Real-time Monitoring: Integration with platforms like Blockaid or Forta can provide early warning systems that detect abnormal transaction patterns before significant damage occurs.
• Audit Depth: The IPayer.pay vulnerability is a known risk. Future audits must place higher scrutiny on “trusted” callbacks that interact with user-approved funds.
• User Education: Shifting the default experience away from unlimited approvals is essential for long-term ecosystem health.

Lessons Learned: The Brutal Reality of 2026 DeFi

The Ekubo exploit adds to a staggering tally. By mid-May 2026, total losses across the DeFi sector have exceeded 1 billion, according to Binance and TRM Labs. April 2026 recorded over 635 million in losses across 28 incidents. High-profile victims include Kelp DAO (293 million) and Drift Protocol (285 million), both of which suffered from messaging vulnerabilities.

The lesson is clear: DeFi composability is a significant attack surface. As protocols interact through routers and aggregators, more points of failure are introduced. An exploit in a minor extension contract can provide a path to drain millions from users who may not realize they are still “connected.” The access-control failure is now a systemic risk threatening the trust of all participants.

User Action Required: Audit Your Approvals Today

If you have ever interacted with Ekubo Protocol on Ethereum or Arbitrum, you must take immediate action. Check your wallet status for any active approvals to the Ekubo EVM v2 Router. Even if you have withdrawn your liquidity, a persistent approval remains active and can be exploited at any time. We recommend the following steps for all DeFi participants:

• Revoke All Approvals: Use Revoke.cash to find and cancel all permissions granted to the Ekubo EVM router contracts.
• Regular Audits: Set a monthly reminder to audit your wallet’s active approvals across all chains. Revoke any permissions for protocols you are no longer actively using.
• Hardware Wallets: Ensure your primary assets are stored in a hardware wallet and only interact with DeFi protocols using a “hot” wallet containing only the funds intended for immediate trade.
• Be Cautious with “Unlimited”: When a dApp asks for permission to spend your tokens, manually edit the spending limit to match only the amount you intend to swap.

The 1.4 million loss at Ekubo and the 6.7 million drain at TrustedVolumes serve as stark reminders that in the world of decentralized finance, code is law—but only if the code is secure. As the industry matures, the focus must shift from rapid innovation to rigorous security standards and proactive defense mechanisms.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.