Kame Aggregator hack — September 2025

Kame Aggregator, a decentralised exchange aggregator on the Sei network, was exploited in September 2025 through a flaw in its AggregationRouter. The router's swap() function executed an arbitrary call to an address and calldata supplied by the caller, with no validation performed on either. An attacker set the executor to a contract they controlled and had it call transferFrom on tokens that users had approved to the router. Funds were therefore taken out of individual wallets that had granted unlimited allowances to the vulnerable contract, not out of a protocol treasury. Verichains, which published the only detailed technical write-up, identified the attacker address, dated the incident 12 September 2025 and put the loss at approximately $1 million. Blockonomi also reported 'over $1 million' but dated the drain to 13 September. Halborn's monthly review put it at $1.3 million. No audited total was ever published, so this record carries $1 million as the headline with $1.3 million as the upper bound, and treats the date as approximate. Kame told users to revoke approvals to the affected contracts and to keep approvals disabled until security checks were finalised. It later confirmed that 185 ETH had been returned to a recovery wallet after the team negotiated directly with the attacker, saying "we have successfully communicated with hackers and they accepted our offer to transfer funds back". Kame said it was gathering information on all affected wallets and that a compensation plan would be shared once the investigation was complete. Blockonomi reported that most of the stolen assets remained unaccounted for. No individual or group has been named as responsible.