Hack history / 2026 / Hack or exploit
ShapeShift FOX Colony
Hack or exploit on May 13, 2026 · Arbitrary External Call
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$133K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,617
among thefts by dollars lost
What happened
An attacker exploited the EtherRouterCreate3 contract's meta-transaction mechanism by abusing the arbitrary self-call capability combined with DSAuth's automatic authorization logic for address(this). The attacker bypassed the auth modifier, replaced the contract's core routing component (resolver) with a malicious version, then used delegatecall to drain all ERC20 assets. A second related exploit shortly after brought total losses to $182.7K.
Details
- Date
- May 13, 2026
- Kind
- Hack or exploit
- Method
- Arbitrary External Call
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Arbitrum
Reported by
Related incidents
ShapeShift 2016 · Hack or exploit · $230K
Aquifer 2026 · Hack or exploit · $2.5M
IPOR Fusion 2026 · Hack or exploit · $336K
Quant 2026 · Hack or exploit · $138K
Custom sAVAX Rebalancer 2026 · Hack or exploit · $64K
Aquifer 2026 · Hack or exploit · $2.5M
IPOR Fusion 2026 · Hack or exploit · $336K
Quant 2026 · Hack or exploit · $138K
Custom sAVAX Rebalancer 2026 · Hack or exploit · $64K
Cite this page
SwanBluechip, "ShapeShift FOX Colony hack, May 13, 2026: $133K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/hta1222905be/ (data as of 2026-10-31).