Stale approvals drained Avalanche Safe of $7.45M

On 26 October 2026 a 2-of-7 Safe multisig on Avalanche C-Chain lost about $7.45M through four token approvals signed in March to an address with no code. The attacker deployed a contract at that address via CreateCall, but an MEV bot front-ran the transaction and later returned most assets for a bounty.

• The Safe granted unlimited approvals for WAVAX, USDC, WETH.e and BTC.b on 7 March 2026
• Using CreateCall, the attacker gained control of the spender address and called transferFrom
• An MEV bot copied the attack and landed first in block 98,605,391
• Drained: 3.09M USDC, 350,375 WAVAX, 181.98 WETH.e and 10.79 BTC.b