Avalanche Safe loses $7.45M to stale approvals as MEV bot front-runs exploit
- —Approvals for WAVAX, USDC, WETH.e and BTC.b were granted on March 7, 2026 and never revoked
- —Address 0x3725…155d hosts the team's pool on other chains but was empty on Avalanche
- —The MEV bot captured 3.09M USDC, 350,400 WAVAX, 182 WETH.e and 10.79 BTC.b
- —Assets from Safes on five chains worth about $38.7M were moved to a single address
Why it matters: The case highlights the risk of reusing deterministic addresses across chains while high-value infinite approvals remain active.
Source: The Crypto Times