Key Takeaways
- An MEV bot exploited a 0x swapper error to drain $300,000 from Coinbase’s corporate DEX wallet.
- The loss stemmed from misconfigured token approvals on the 0x Project’s swapper contract.
- Coinbase confirmed no customer funds were affected, and the issue has been contained.
A misconfigured token approval to the 0x Project’s swapper contract allowed an MEV (Maximal Extractable Value) bot to drain approximately $300,000 from a Coinbase corporate DEX wallet.
The error effectively handed the attacker spending rights over fee-accrued tokens, which were immediately pulled on-chain.
What Went Wrong
The 0x swapper contract is a permissionless, stateless router for token swaps — not a token vault.
By design, it shouldn’t hold approvals, as anyone can call it and execute arbitrary swaps using pre-approved tokens.
In this case, Coinbase’s corporate wallet — which collects protocol fees — mistakenly granted approval for accrued tokens to the swapper.
Once approved, MEV searchers detected the allowance in the mempool, built profitable bundles around it, and executed transactions that drained the wallet.
The contract’s open-access nature made the attack trivial: no private key compromise was needed, just the right call to a contract already authorized to spend tokens.
The absence of anti-MEV or slippage protections meant the wallet was fully exposed.
Expert Warning
Security researcher Dee Beez flagged that the same 0x swapper had previously been abused in Base’s Zora claim flow, warning that “this swapper is never meant to get approvals.”
It allows arbitrary external calls, meaning that once approvals are set, any actor — including MEV bots — can route transactions to drain funds.
Coinbase’s Response
Philip Martin, Coinbase’s Chief Security Officer, confirmed the loss was limited to a corporate DEX wallet and no customer funds were at risk.
Coinbase has since revoked token allowances and migrated remaining assets to a hardened wallet configuration.
MEV extraction remains one of DeFi’s most persistent attack surfaces. In 2021, a Uniswap V3 sandwich attack netted $10–$20 million for searchers; in 2022, a Sushiswap routing exploit resulted in nearly $300,000 in losses.
The Coinbase incident reinforces that even major institutions are not immune to the operational risks of interacting with permissionless DeFi infrastructure.
Recommended Secure Partners
Prashant Jha is a seasoned crypto journalist based in Delhi, India, with a Bachelor’s Degree in Computer Science Engineering. Passionate about the evolving world of blockchain and cryptocurrencies, he has been a dedicated voice in the industry since 2018. Prashant’s expertise lies in regulatory reporting, where he unravels complex legal and financial developments with clarity and precision. Before joining CCN in 2024, he honed his craft at Cointelegraph, establishing himself as a trusted name in crypto journalism.
His coverage spans major industry events, including the high-profile collapses of FTX, Three Arrows Capital (3AC), and LUNA, offering readers insightful analyses of their regulatory and market implications. Prashant’s technical background enables him to bridge the gap between intricate blockchain technology and its real-world applications, making his work accessible to novices and experts.
Beyond his professional pursuits, Prashant is an avid music enthusiast, often exploring diverse genres to unwind. A sports lover, he has a particular passion for cricket and frequently engages in discussions about the game. His multifaceted interests and sharp journalistic instincts make him a valuable contributor to CCN, where he continues shaping the crypto landscape's narrative.
