Coinbase Hit by $300,000 Loss From Token Approval Mistake

Cryptos: 21,330
Exchanges: 2,043
Market Cap: $4.05T 2.19%
24h Vol: $629,354,112,951 0.59%
Dominance: BTC: 58.3% ETH: 13.8%
Gas: 0.326 GWEI

Connect

Crypto News Exploits

Coinbase Hit by $300,000 Loss From Token Approval Mistake

Written by Aaron S.,

Editor-In-Chief

Last Updated: August 15, 2025

Key Takeaways

Coinbase lost about $300,000 after its corporate wallet approved tokens to a 0x swap contract;
Researcher Deebeez spotted the approvals, which let an MEV bot move the tokens without hacking;
Coinbase removed approvals, moved remaining funds, and confirmed no customer accounts were impacted.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now! 🔥

Coinbase Hit by $300,000 Loss From Token Approval Mistake

BITDEGREE IN YOUR SOCIAL FEED

The crypto exchange Coinbase $3.89B has confirmed losing around $300,000 in tokens after a mistake involving one of its corporate wallets used for decentralized exchange transactions.

Chief security officer Philip Martin said the problem was caused by a configuration change and only affected the company’s own funds.

He added that the token approvals were removed and the rest of the assets were moved to a new wallet. No customer balances were impacted.

ICO vs IDO vs IEO: Which One's the Best? (Easily Explained)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The issue was first spotted by Deebeez, a security researcher from Venn Network. He explained in an August 13 post on X that Coinbase’s wallet interacted with the 0x Project’s "swapper" contract. This contract is meant for carrying out token swaps, not for holding approvals that allow tokens to be taken later.

Because the swapper contract can be called by anyone, these approvals made the funds vulnerable to being taken right away. Deebeez pointed out that similar problems have happened before with Zora-related claims on the Base network.

In those cases, attackers were able to take assets simply because they had been approved for the wrong type of contract.

Deebeez also shared screenshots that showed Coinbase approved several tokens on August 13, including Amp AMP $0.0036 , DEXTools DEXT $0.4933 , MyOneProtocol, and Swell Network. Later, a maximal extractable value (MEV) bot used the swapper contract to move those tokens from Coinbase’s fee receiver wallet into its own accounts.