Coinbase Hit by $300,000 Loss From Token Approval Mistake

Crypto News Exploits

Written by Aaron S.,

Editor-In-Chief

Last Updated: August 15, 2025

Key Takeaways

Coinbase lost about $300,000 after its corporate wallet approved tokens to a 0x swap contract;
Researcher Deebeez spotted the approvals, which let an MEV bot move the tokens without hacking;
Coinbase removed approvals, moved remaining funds, and confirmed no customer accounts were impacted.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Coinbase Hit by $300,000 Loss From Token Approval Mistake

BITDEGREE IN YOUR SOCIAL FEED

The crypto exchange Coinbase $2.07B has confirmed losing around $300,000 in tokens after a mistake involving one of its corporate wallets used for decentralized exchange transactions.

Chief security officer Philip Martin said the problem was caused by a configuration change and only affected the company’s own funds.

He added that the token approvals were removed and the rest of the assets were moved to a new wallet. No customer balances were impacted.

Crypto Research Fundamentals: How to DYOR (Animated Explainer)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The issue was first spotted by Deebeez, a security researcher from Venn Network. He explained in an August 13 post on X that Coinbase’s wallet interacted with the 0x Project’s "swapper" contract. This contract is meant for carrying out token swaps, not for holding approvals that allow tokens to be taken later.

Because the swapper contract can be called by anyone, these approvals made the funds vulnerable to being taken right away. Deebeez pointed out that similar problems have happened before with Zora-related claims on the Base network.

In those cases, attackers were able to take assets simply because they had been approved for the wrong type of contract.

Deebeez also shared screenshots that showed Coinbase approved several tokens on August 13, including Amp AMP $0.0021 , DEXTools DEXT $0.2193 , MyOneProtocol, and Swell Network. Later, a maximal extractable value (MEV) bot used the swapper contract to move those tokens from Coinbase’s fee receiver wallet into its own accounts.