Ethereum router approval exploit drains users on Ekubo’s Huff router

Ekubo said an incident involving its Huff router on Ethereum allowed attackers to spend existing ERC-20 approvals and drain user funds. In its official incident post, the project said the problem came from a calldata-parsing bug in the router, which let a third party use previously granted approvals against the contract.

The company said the issue affected users who had approved the router in advance, a common DeFi pattern that lets a contract move tokens on a user’s behalf. In this case, that permission became the exposure point: once an approval existed, the flaw made it possible for attackers to spend tokens through the router without a fresh user action.

Separate security commentary linked the same type of approval abuse to roughly 65 approved holders and about 66 BNB in outflows, while describing standing approvals to the router as a continuing risk until revoked. That scale figure should be treated cautiously unless the affected wallets and token movements are independently confirmed, but it is consistent with the broader approval-based attack pattern.

Why token approvals became the attack surface

Token approvals are standard in DeFi because routers and other contracts often need permission to transfer assets during swaps, deposits or other on-chain actions. The downside is that those approvals can remain active after the original transaction, leaving a wallet exposed if the contract later contains a bug or is otherwise abused.

In that setup, the vulnerability is not a price event or a market move; it is a permissions problem. The danger comes from the contract’s ability to call transferFrom or a similar token-moving function against wallets that already signed approval transactions.

Ekubo’s report suggests the incident belonged to that category. Users who have approved the router may need to review and revoke permissions where possible, especially if they no longer intend to interact with the contract.