Blockchain security firm CertiK has reported a recent exploit involving a proxy contract address (0x0689…4B43) that drained approximately $340,000 from user wallets. The source of the breach? A USDC token approval granted all the way back in 2020.
This incident highlights the persistent risks associated with leaving old token approvals unchecked. When users approve a smart contract to spend tokens on their behalf, that permission remains active indefinitely—unless manually revoked.
What Happened in the $340K Exploit?
According to CertiK, the attacker exploited a proxy contract that had lingering permissions from years ago. Specifically, the affected wallets had previously approved USDC token transfers to this contract. These outdated approvals enabled the attacker to drain funds without needing any new interaction from the wallet holders.
It’s a chilling reminder that smart contracts can be upgraded or repurposed in malicious ways—especially proxy contracts that separate the logic and data layers. If an attacker gains control of the logic, they can execute arbitrary commands using the permissions already granted.
ALERT: CertiK reports an exploit on proxy contract 0x0689…4B43 that drained roughly $340K, tied to a $USDC approval the user granted back in 2020.
— Cointelegraph (@Cointelegraph) December 3, 2025
Users are urged to review their wallets and revoke outdated permissions. pic.twitter.com/i5J2OIK8i3
How to Stay Safe: Revoke Unused Permissions
Crypto users are strongly advised to review and revoke outdated approvals regularly. Free tools like Etherscan Token Approval Checker or Revoke.cash can help identify and remove unnecessary allowances.
Even if your wallet seems safe today, an old approval could make it vulnerable tomorrow—especially if the smart contract it points to is compromised or upgraded by a malicious actor. Regular maintenance of your wallet permissions is just as important as keeping your private keys secure.