Ekubo Protocol

avoid.net/ekubo-protocol→42/100·82% conf.

[AI-DRAFTED · AWAITING VERIFICATION]

42/100

[WARNING]82% conf.

Summary

Ekubo Protocol is a concentrated-liquidity DEX built primarily on Starknet, founded by ex-Uniswap lead engineer Moody Salem and backed by Uniswap Labs Ventures. On May 5, 2026, a missing payer-validation check in the IPayer.pay callback of its EVM swap router contracts allowed an attacker to drain approximately $1.4 million in WBTC from a single victim wallet across 85 rapid transactions, with the Starknet core deployment and liquidity providers remaining unaffected. The stolen funds were subsequently converted to ETH and routed through Tornado Cash.

Connected Entities

1 entities · 10 linked investigations

Protocols

⌂Ekubo Protocol

Relationships

Also appears in

edgeX Exchange·28 Saga EVM Blockchain·32 Mach-O Man Malware Campaign (Lazarus / Chollima)·0 Q2 2026 DeFi Record Hack Wave·0 Gamma Strategies·28 Alephium Bridge·18 Bunni Protocol·28 Trenton Johnston·0 Lulo·55 Thorchain DEX·28

Have evidence about Ekubo Protocol?

Timeline(7 events)

2022-01-01

Ekubo Protocol founded by Moody Salem, former lead engineer at Uniswap.

Starknet Blog

2024-01-01

Uniswap Labs Ventures invests $12 million in Ekubo at a $60 million valuation.

Uniswap Governance Forum

2026-05-05

Attacker EOA 0xa911ff351b143634dbc5af3e204ea074583a83e3 exploits missing payer validation in Ekubo EVM router IPayer.pay callback. 85 transactions drain 17 WBTC (~$1.4M) from victim 0x765decf4fa157756e850c1079f60801b9219edd1 beginning at 17:50:35 UTC in block 25030409, transaction 0x770bc9a1f7c32cb63a5002b9ceb5c7994cd3af0fc6b2309cb32d3c46f629daa0.

DARKNAVY Technical Analysis

2026-05-05

Stolen 17 WBTC converted to approximately $404K USDC, $403K DAI, and 239.5 ETH via Velora; proceeds subsequently routed through Tornado Cash.

AMBCrypto

2026-05-05

Ekubo posts security alert on X, confirming active incident on EVM swap router contracts only and urging all users to revoke approvals via revoke.cash. Starknet and liquidity providers confirmed unaffected.

Ekubo Protocol on X

2026-05-06

The Block, Bankless, and AMBCrypto publish reporting on the exploit. Blockaid credited with root-cause identification.

The Block

2026-05-06

Ekubo launches refund portal for affected EVM users. Full post-mortem promised but not yet published as of mid-June 2026.

Phemex News

Provenance & Audit Trail

Anchored on Solana Verify on-chain