Hack history / 2026 / Hack or exploit
SquidMulticall
Hack or exploit on Apr 7, 2026 · Improper Access Control
ATTACK TX CONFIRMED ON CHAINSOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$517K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,137
among thefts by dollars lost
What happened
SquidMulticall exposes a permissionless run() function that executes arbitrary external calls with no access control. When users mistakenly approved tokens directly to SquidMulticall (instead of Squid Router), attackers could call run() with transferFrom() payloads to drain those approvals across multiple chains. A wallet with $623K in infinite approvals was compromised, resulting in $517K extracted.
Details
- Date
- Apr 7, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Arbitrum, BNB Chain, Avalanche, Optimism, Base
Reported by
Related incidents
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "SquidMulticall hack, Apr 7, 2026: $517K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htc78b71ffaf/ (data as of 2026-10-31).