Avalanche Safe Loses $7.45M to Misconfigured Approvals as MEV Bot Front-Runs Drain
By Crypto Wire
October 27, 2026
A trading team’s 2-of-7 Safe multisig on Avalanche lost roughly $7.45 million after months-old unlimited token approvals pointed at an empty contract address that an attacker later claimed — and an MEV bot front-ran the drain in the same block. Defimon Alerts surfaced the intercepted exploit and said it first detected the activity at 13:00:23 UTC on October 26. Desk wraps published Tuesday, including The Crypto Times, add the recovery beat: Safe owners offered a bounty of 42,500 WAVAX (about $371,000 on Defimon’s dollar line) while the captured stack still sits pending return.
The forensic path starts with a cross-chain address collision, not a stolen key. On March 7, 2026 at 16:10 UTC, the Safe granted unlimited spending rights for WAVAX, USDC, WETH.e, and BTC.b to 0x3725bd4d175283108156c3f15f86e1c51266155d. On Base, Arbitrum, and Ethereum that address hosts the team’s pool contract. On Avalanche the same hash was empty — Defimon says it is what Safe’s public CreateCall factory produces on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals were never revoked. A fresh EOA deployed CreateCall through the Safe singleton factory, burned 12 throwaway deployments to advance the nonce, then parked a sweeper at the target address to pull every approved balance.
The attacker’s drain did not stick. An MEV bot copied the transaction and executed first in the same block, taking about 3.09 million USDC, 350,400 WAVAX, 182 WETH.e, and 10.79 BTC.b. Defimon says the original attack transaction then reverted. The bot has described itself as a whitehat and posted on-chain messages offering to return funds to a designated address for a 5–10% bounty. Seized assets remain at 0x11eb9b677510e2594857f4d137fd12a7fef39bc5 pending resolution — collectors should treat that wallet as the live custody print, not as a finished recovery.
Tuesday’s new negotiation fact is the WAVAX-denominated bounty. Defimon later reported that the Safe owners offered 42,500 WAVAX, and a follow-up Avalanche transaction carries an input-data message agreeing that the bot may keep that amount if it proceeds with the remaining transfers. Attribute the bounty figure and dollar conversion to Defimon’s alert line and the on-chain message trail; do not invent a completed return receipt until the transfers clear. As of the Tuesday wraps, negotiation continued and the ~$7.45 million stack was still under the bot’s control.
Exposure control outside Avalanche is the second trail. The same operator runs Safes on other networks. Beginning at 13:48 UTC on October 26, signers moved assets out of Safes on HyperEVM, Base, Robinhood Chain, BSC, and Ethereum into a single fresh address, 0x70d54baf9ffa48b8fe4e843774a44e24ff452099, which Defimon put near $38.7 million. That consolidation matters for NFT and crypto desks watching multi-chain inventory risk: a standing Avalanche approval to a deterministic empty CreateCall slot can sit quiet for months, then become a live spend path the moment someone claims the address.
Keep this chapter separate from other October security beats already on the shelf — Initia’s mint-bridge halt and partner-audit fix, BloomTrading’s Solana drain refunds, and Keystone’s hardware-wallet shipping breach. Those were different exploit paths and recovery clocks. Today’s unused primary is the Avalanche Safe approval collision, the same-block MEV front-run, and the 42,500 WAVAX bounty negotiation while funds remain parked.
For collectors and desks signing against multi-chain Safe inventories, the practical checks are (1) whether approvals still point at addresses that are live contracts on some chains and empty CreateCall slots on others, (2) whether the MEV wallet 0x11eb…bc5 prints the remaining return transfers after the WAVAX bounty terms, and (3) whether the consolidated 0x70d5…2099 stack stays quiet or hops again. Infinite approvals to a chain-local empty address are a standing authorization — revoke or redeploy before the next claim race.
What to watch on-chain next: whether wallet 0x11eb…bc5 completes the remaining return transfers after the 42,500 WAVAX bounty terms, and whether 0x70d5…2099 stays quiet or prints a new hop after the multi-chain Safe evacuation — those two receipts settle recovery more than any whitehat label.
Bottom line: An Avalanche 2-of-7 Safe lost about $7.45 million to unrevoked cross-chain approvals after an MEV bot front-ran the sweeper, with owners offering 42,500 WAVAX (~$371K) while return transfers remain pending.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
