{"investigation":{"slug":"kame-aggregator","entity_name":"Kame Aggregator","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Kame Aggregator is a decentralized exchange (DEX) aggregator protocol built on the Sei blockchain, launched in late May 2025, designed to route token swaps across multiple liquidity sources for optimal pricing. On September 13, 2025, the protocol suffered a critical smart contract exploit in which approximately $1.325 million was drained from 830 user wallets via an arbitrary external call vulnerability in its swap() function. The primary exploiter returned approximately $946,000 after negotiations, while secondary exploiters retained approximately $357,000; the team initiated a compensation program that reached over $1 million USDC in distributions by November 2025.","sections":[{"content":"On September 13, 2025, Kame Aggregator's AggregationRouter smart contract was exploited via an arbitrary external call vulnerability in its swap() function. The function allowed arbitrary execution of params.executor with params.executeParams without validation of either the executor address or the calldata. Attackers designated a malicious Multicall contract (address 0xcA11bde05977b3631167028862bE2a173976CA11) as the executor, which then invoked transferFrom() directly against users who had previously granted unlimited token approvals to the Kame router contracts at addresses 0x14bb98581Ac1F1a43fD148db7d7D793308Dc4d80 and 0x1415E8eeC45DAE07E7bBdf57A88ea0a309233617. Approximately 830 unique user accounts were affected. Total assets drained were approximately $1,324,535 USD. A primary exploiter was responsible for the majority of the theft and subsequently negotiated with the Kame team, agreeing to a 20% bounty arrangement and returning approximately $946,195 in funds. White hat hackers assisted in recovering an additional $21,900. Secondary exploiters who acted opportunistically during the incident retained approximately $356,438 that was not recovered.","heading":"Security Exploit — September 2025","sources":[{"url":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","name":"kameagg.substack.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/kame","name":"revoke.cash","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/kameaggregatorswapfunctionarbitraryexecutorcallbug.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://blockonomi.com/kame-aggregator-on-sei-hit-by-1m-exploit-hacker-returns-185-eth","name":"blockonomi.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The root cause of the exploit was a critical design flaw in the AggregationRouter contract's swap() function, which performed no validation on the executor parameter or associated calldata. This class of vulnerability — arbitrary external call — allowed any caller to designate an arbitrary contract as the executor and pass any calldata, effectively weaponizing users' existing unlimited token approvals as a theft mechanism. The Kame team's post-mortem identified five remediation requirements: eliminating arbitrary external calls, implementing strict executor whitelisting, deploying real-time monitoring systems, conducting enhanced third-party audits, and adding suspend/upgrade functionality to the aggregator contract. Prior to the exploit, no evidence has surfaced publicly that the protocol had undergone a formal security audit from a recognized firm. The absence of pre-deployment auditing is a significant contributing factor to the exploit.","heading":"Technical Vulnerability Analysis","sources":[{"url":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","name":"kameagg.substack.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/kameaggregatorswapfunctionarbitraryexecutorcallbug.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://blog.verichains.io/p/the-hidden-danger-of-unlimited-token","name":"blog.verichains.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Upon detecting the exploit, the Kame team issued immediate alerts across X (formerly Twitter), Telegram, and Discord, urging users to revoke token approvals using tools such as Revoke.cash and Rabby Wallet. This early warning limited the total damage as a portion of users revoked permissions before their funds were drained. The team established direct communications with the primary exploiter and offered a 20% bounty (white-hat arrangement) in exchange for return of the bulk of the stolen funds. The primary exploiter accepted and transferred 185 ETH to a designated recovery wallet via an on-chain Ethereum transaction. The total value recovered from the primary exploiter was approximately $946,195. White hat hackers recovered an additional approximately $21,900. Approximately $356,438 stolen by secondary exploiters was not recovered.","heading":"Incident Response and Fund Recovery","sources":[{"url":"https://www.cryptopolitan.com/kame-aggregator-recovers-185-eth/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://coinedition.com/kame-aggregator-185eth-recovery-sei-hack/","name":"coinedition.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/kame","name":"revoke.cash","type":"other","credibility":3},{"url":"https://www.mexc.com/news/95334","name":"mexc.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Kame announced a compensation plan for affected users, committing to full reimbursement of losses. By November 2025, the team had distributed over $1,031,115 USDC across multiple compensation rounds to affected users, including a round in November 2025 distributing an additional 36,977.61 USDC. The team indicated they were working toward fulfilling 100% of their compensation commitment. The protocol's willingness to initiate and follow through on a compensation program is a positive indicator, though approximately $356,000 in losses caused by secondary exploiters represents funds that needed to be sourced from the team's own treasury or other means. The full completion status of the compensation program and details of its funding source had not been publicly confirmed in sources reviewed.","heading":"Compensation Program","sources":[{"url":"https://www.mexc.com/news/95334","name":"mexc.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/kame-aggregator-recovers-185-eth-posthack-plans-user-compensation-18436","name":"phemex.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/kame","name":"revoke.cash","type":"other","credibility":3}],"severity":"medium"},{"content":"Kame Aggregator launched on the Sei blockchain in late May 2025 as the network's first native DEX aggregator. The protocol aggregates liquidity across more than 12 sources including DragonSwap, Yaka Finance, Astroport, and SushiSwap, and at launch claimed to scan approximately 98% of Sei's total value locked (TVL). The protocol was founded by Juan Delgado and Carlos Delgado, along with at least one additional co-founder. The team's identities appear to be partially public via Tracxn and related databases. No evidence of regulatory actions, SEC enforcement, or OFAC sanctions against Kame Aggregator or its founders has been identified in the sources reviewed. No evidence of rug pull, exit scam, or deliberate fraud by the team has been identified; the incident is categorized as a smart contract exploit rather than insider theft.","heading":"Protocol Background and Legitimacy","sources":[{"url":"https://stouy.com/kame-dex-aggregator-on-sei-guide/","name":"stouy.com","type":"other","credibility":3},{"url":"https://web3.bitget.com/en/dapp/kame-aggregator-31324","name":"web3.bitget.com","type":"other","credibility":3},{"url":"https://tracxn.com/d/companies/kame/__8YJXssv554ck8xcBPEZIFCjFYJLEEmiehR6l3qua8rU/founders-and-board-of-directors","name":"tracxn.com","type":"other","credibility":3},{"url":"https://alphagrowth.io/kame-aggregator","name":"alphagrowth.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Users who interacted with Kame Aggregator prior to September 13, 2025, and have not yet revoked their token approvals to the affected contracts (0x14bb98581Ac1F1a43fD148db7d7D793308Dc4d80 and 0x1415E8eeC45DAE07E7bBdf57A88ea0a309233617) remain at potential risk if any residual vulnerabilities or re-deployed malicious contracts exist. Revoke.cash maintains a dedicated page for checking and revoking affected approvals. The protocol's status as of mid-2026 — whether it has relaunched, undergone formal audits, and implemented the security improvements outlined in its post-mortem — could not be fully confirmed from publicly available sources reviewed. The lack of a confirmed pre-deployment audit, combined with a significant exploit within the protocol's first four months of operation, represents a material risk factor for prospective users.","heading":"Ongoing Risk Factors","sources":[{"url":"https://revoke.cash/exploits/kame","name":"revoke.cash","type":"other","credibility":3},{"url":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","name":"kameagg.substack.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-05","event":"Kame Aggregator launches on the Sei blockchain as the network's first native DEX aggregator, aggregating liquidity from 12+ sources.","source":"","date_original":"2025-05-01"},{"date":"2025-09-13","event":"Critical exploit in the AggregationRouter swap() function; attackers abuse arbitrary external call vulnerability and unlimited token approvals to drain approximately $1.325 million from 830 user wallets.","source":""},{"date":"2025-09-13","event":"Kame team detects exploit and immediately alerts users across X, Telegram, and Discord to revoke token approvals. Platform temporarily closes.","source":""},{"date":"2025-09-13","event":"Kame team establishes direct contact with primary exploiter and begins negotiation.","source":""},{"date":"2025-09-14","event":"Primary exploiter accepts 20% bounty offer and transfers 185 ETH (~$946,195) to Kame's recovery wallet via on-chain Ethereum transaction.","source":""},{"date":"2025-09-14","event":"White hat hackers recover an additional approximately $21,900 from the exploit.","source":""},{"date":"2025-09-14","event":"Kame publishes post-mortem detailing the vulnerability, affected contracts, and five-point remediation plan.","source":""},{"date":"2025-10","event":"Kame begins rolling out compensation distributions to affected users in multiple stages.","source":"","date_original":"2025-10-01"},{"date":"2025-11","event":"Cumulative compensation distributions exceed $1,031,115 USDC across all stages; team states commitment to 100% reimbursement.","source":"","date_original":"2025-11-01"}],"sources_used":[{"url":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","name":"kameagg.substack.com","type":"other","archive_url":"http://web.archive.org/web/20251119161116/https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","credibility":3,"archive_timestamp":"2025-11-19T16:11:16+00:00"},{"url":"https://revoke.cash/exploits/kame","name":"revoke.cash","type":"other","archive_url":"http://web.archive.org/web/20260417003739/https://revoke.cash/exploits/kame","credibility":3,"archive_timestamp":"2026-04-17T00:37:39+00:00"},{"url":"https://quadrigainitiative.com/casestudy/kameaggregatorswapfunctionarbitraryexecutorcallbug.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260422112355/https://quadrigainitiative.com/casestudy/kameaggregatorswapfunctionarbitraryexecutorcallbug.php","credibility":3,"archive_timestamp":"2026-04-22T11:23:55+00:00"},{"url":"https://blockonomi.com/kame-aggregator-on-sei-hit-by-1m-exploit-hacker-returns-185-eth","name":"blockonomi.com","type":"other","archive_url":"http://web.archive.org/web/20260610130244/https://blockonomi.com/kame-aggregator-on-sei-hit-by-1m-exploit-hacker-returns-185-eth/","credibility":3,"archive_timestamp":"2026-06-10T13:02:44+00:00"},{"url":"https://blog.verichains.io/p/the-hidden-danger-of-unlimited-token","name":"blog.verichains.io","type":"other","archive_url":"http://web.archive.org/web/20260515161213/https://blog.verichains.io/p/the-hidden-danger-of-unlimited-token","credibility":3,"archive_timestamp":"2026-05-15T16:12:13+00:00"},{"url":"https://www.cryptopolitan.com/kame-aggregator-recovers-185-eth/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20251008233639/https://www.cryptopolitan.com/kame-aggregator-recovers-185-eth/","credibility":3,"archive_timestamp":"2025-10-08T23:36:39+00:00"},{"url":"https://coinedition.com/kame-aggregator-185eth-recovery-sei-hack/","name":"coinedition.com","type":"other","archive_url":"http://web.archive.org/web/20250914132127/https://coinedition.com/kame-aggregator-185eth-recovery-sei-hack/","credibility":3,"archive_timestamp":"2025-09-14T13:21:27+00:00"},{"url":"https://www.mexc.com/news/95334","name":"mexc.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://phemex.com/news/article/kame-aggregator-recovers-185-eth-posthack-plans-user-compensation-18436","name":"phemex.com","type":"other","archive_url":"http://web.archive.org/web/20251015145438/https://phemex.com/news/article/kame-aggregator-recovers-185-eth-posthack-plans-user-compensation-18436","credibility":3,"archive_timestamp":"2025-10-15T14:54:38+00:00"},{"url":"https://stouy.com/kame-dex-aggregator-on-sei-guide/","name":"stouy.com","type":"other","archive_url":"https://web.archive.org/web/20260829120035/https://stouy.com/kame-dex-aggregator-on-sei-guide/","credibility":3,"archive_timestamp":"2026-08-29T12:00:35+00:00"},{"url":"https://web3.bitget.com/en/dapp/kame-aggregator-31324","name":"web3.bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260829082804/https://web3.bitget.com/dapp/kame-aggregator-31324","credibility":3,"archive_timestamp":"2026-08-29T08:28:04+00:00"},{"url":"https://tracxn.com/d/companies/kame/__8YJXssv554ck8xcBPEZIFCjFYJLEEmiehR6l3qua8rU/founders-and-board-of-directors","name":"tracxn.com","type":"other","archive_url":"https://web.archive.org/web/20260830034008/https://tracxn.com/d/companies/kame/__8YJXssv554ck8xcBPEZIFCjFYJLEEmiehR6l3qua8rU#reports","credibility":3,"archive_timestamp":"2026-08-30T03:40:08+00:00"},{"url":"https://alphagrowth.io/kame-aggregator","name":"alphagrowth.io","type":"other","archive_url":"https://web.archive.org/web/20260829112209/https://alphagrowth.io/kame-aggregator","credibility":3,"archive_timestamp":"2026-08-29T11:22:09+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:15.645733+00:00","updated_at":"2026-08-30T03:54:57.822735+00:00"}}