Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Squid Multicall Approval Exploit: $517.00K Reported Loss

·Historical incident record

Incident Overview

A user mistakenly approved the SquidMulticall contract (instead of the intended Squid Router contract) with unlimited token allowances. An attacker then called the permissionless run() function on SquidMulticall with crafted calldata to execute transferFrom() from the victim’s approved tokens across multiple chains (ETH, BSC, Arbitrum, Avalanche, etc.). This drained approximately $517K.

Sources & References

Original incident referencehttps://blocksec.com/blog/weekly-web3-security-incident-roundup-apr-6-apr-12-2026 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Aethir

    Attack methodSmart Contract Vulnerability
    Reported loss$ 90,000
  2. Incident date
    Target

    Dango

    Attack methodInsurance Fund Logic Vulnerability
    Reported loss$ 1,900,000
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 2,500,000
  4. Incident date
    Attack methodSocial Engineering
    Reported loss$ 285,000,000
  5. Incident date
    Target

    TGAI

    Attack methodReserve Manipulation Attack
    Reported loss$ 11,940