Coinbase fell victim to a significant loss of approximately $300,000 due to a misconfiguration in its interactions with the 0x protocol’s swapper contract. This lapse allowed MEV bots to drain funds directly from a corporate wallet owned by Coinbase.

Key Points:

• Coinbase’s chief security officer Philip Martin confirmed no customer funds were compromised during the exploit.
• The exploit resulted from the approval of tokens to a swapper contract, which was not intended for holding token allowances, enabling the MEV bots to drain the wallet immediately after approvals were granted.

MEV, or maximal extractable value, is a technique used in cryptocurrency transactions that allows bots to profit by front-running or reordering transactions. The exploit was flagged by security researcher deeberiroz, highlighting the vulnerability even top-tier exchanges face against sophisticated automated trading methods.

“Looks like @coinbase was recently drained of ~$300,000 after using @0xProject swapper incorrectly… The bots simply waited for a high-value wallet to grant spending rights to an exposed contract, then executed the drain immediately.” - deeberiroz