Unizen hack — March 2024

On 9 March 2024 an attacker drained roughly $2.1 million from users of Unizen, a cross-chain trade aggregator, by abusing token approvals held against its Ethereum aggregation contract.

The money did not come from a protocol treasury. Unizen had recently upgraded the proxy behind its aggregation contract, a change reviewers describe as intended to optimise gas usage. The upgraded code performed an external call without adequately restricting the call target, so an attacker could direct the contract to call arbitrary addresses and, through them, move tokens out of any wallet that still had an open approval to it. Halborn described the root cause as an unsafe external call. A forensic review of the transactions found the attack executed across fourteen transactions through two attack contracts, sweeping many victim wallets at once. PeckShield publicly flagged an approve issue and Cyvers detected the transactions on-chain.

The proceeds were taken in USDT and converted to DAI. Roughly five months later 2,179,859 DAI was moved to a fresh wallet, swapped for about 865 ETH on Uniswap, and passed through Tornado Cash in 26 transactions. Unizen offered the attacker a 20% bounty; the attacker never engaged.

Founder and CEO Sean Noga loaned the company funds to reimburse users personally. Anyone who lost $750,000 or less was made whole in USDC or USDT sent directly to the affected wallet, beginning 11 March; larger losses were handled case by case.

The headline figure is consistently reported as about $2.1 million at the time of the incident. The upper bound of the range reflects the 2,179,859 DAI later traced and laundered, a face value recorded roughly five months afterwards rather than a valuation at the moment of the theft.