Ekubo Protocol Exploited for $1.4 Million in WBTC via EVM Router Vulnerability

Ekubo Protocol, a decentralized finance platform built on the StarkNet ecosystem, has suffered a significant security breach, losing approximately $1.4 million worth of Wrapped Bitcoin (WBTC). The exploit, first reported by The Block, targeted a vulnerability in the protocol’s Ethereum Virtual Machine (EVM) swap router.

How the Attack Unfolded

Blockchain security firm Blockaid identified the root cause as a flaw within the Ekubo v2 EVM extension contract. The attacker exploited this weakness through a series of approximately 85 consecutive transactions, systematically draining funds from the protocol. The primary victim, a single liquidity provider, lost around 17 WBTC, which was immediately converted into Wrapped Ether (WETH) and Dai (DAI) stablecoin to obfuscate the trail and realize the stolen value.

Implications for DeFi Security and Cross-Chain Bridges

This incident underscores the persistent security challenges facing the decentralized finance sector, particularly in protocols that bridge different execution environments. Ekubo’s use of an EVM router within the non-EVM StarkNet ecosystem introduces a complex attack surface. The exploit highlights the risks associated with smart contract extensions that facilitate cross-chain or cross-virtual machine operations, a common feature in multi-chain DeFi architectures.

What This Means for Users and the Market

For users, the event is a stark reminder of the importance of due diligence when providing liquidity to protocols with novel or complex technical architectures. While the total loss is relatively small compared to major DeFi hacks, the methodical nature of the attack—using 85 transactions to avoid triggering alarms—demonstrates a sophisticated understanding of the protocol’s internal logic. The market impact has been contained so far, but the incident may prompt other protocols to audit their own EVM compatibility layers more rigorously.

Conclusion

The Ekubo Protocol exploit is a targeted attack on a specific vulnerability in its EVM swap router, resulting in a $1.4 million loss for a single liquidity provider. The incident adds to the growing list of DeFi security failures and reinforces the need for continuous, in-depth smart contract audits, especially for cross-environment integrations. Users and developers alike should view this as a cautionary tale about the risks inherent in bridging different blockchain technologies.

FAQs

Q1: What was the total amount lost in the Ekubo Protocol exploit?
The total loss is approximately $1.4 million worth of Wrapped Bitcoin (WBTC), equivalent to about 17 WBTC.

Q2: How did the attacker exploit the protocol?
The attacker exploited a vulnerability in the Ekubo v2 EVM extension contract, using 85 consecutive transactions to drain funds through the protocol’s EVM swap router.

Q3: What happened to the stolen funds?
The stolen WBTC was quickly converted into Wrapped Ether (WETH) and Dai (DAI) stablecoin to make the funds harder to trace and to realize the value in more liquid assets.