Avalanche Safe: A Forgotten Permission Left $7.45M Open, and a Bot Grabbed It Before the Thief

At 12:56 UTC on Monday 26 October 2026, a shared wallet on the Avalanche blockchain was emptied in a single transaction. It held about $7.45 million: roughly 3.09 million USDC, a digital dollar issued by the company Circle, plus about 350,000 AVAX, 182 ether and 10.8 bitcoin, all in the wrapped forms that Avalanche uses. No password was stolen and nobody was tricked into signing anything. The door had been left open since March.

The strange part is who walked through it. The thief who found the opening did not get the money. An automated trading program, a bot, spotted the thief's transaction while it was waiting to be processed, copied it, and got its own copy processed first. The thief's version failed because there was nothing left to take. A day later the bot handed back almost everything and kept 42,500 AVAX, about $371,000, as a reward the owners agreed to pay.

Whose money it was

The owners have not been named. The wallet was a Safe, a widely used kind of shared account (formerly called Gnosis Safe) that needs several people to sign before money can move, like a company bank account that needs two directors to countersign a cheque. This one needed any 2 of its 7 signers. CryptoTimes described it as belonging to a trading team. The reconstruction by BlockintAI, an analysis account, called the money trading inventory. No company, fund or person has said the wallet was theirs, and no public statement from the owners has appeared.

What is known is that the same operator runs similar Safes on other networks. From 13:48 UTC that afternoon, less than an hour after the drain, its signers moved assets out of Safes on Ethereum, Base, BNB Chain, HyperEVM and Robinhood Chain into one new address. Defimon Alerts, the monitoring service that first flagged the drain at 13:00 UTC, put that consolidated pot at about $38.7 million.

The forgotten permission

On 7 March 2026, the Safe's signers approved one batch transaction. It gave unlimited permission to spend four of its tokens (USDC, AVAX, ether and bitcoin) to one particular address. In crypto this is called a token approval. It works like a standing direct debit on a bank account: once granted, the named party can take money whenever it likes, up to the limit, without asking again. These approvals were set to no limit at all, and nobody ever cancelled them.

On Ethereum, Base and Arbitrum, that address holds the team's own trading contract, a piece of code that moves money by itself. The approval was presumably meant for that. But blockchains are separate networks that share the same address format, a bit like two towns that both use the same street numbers. On Avalanche, the house at that number had never been built. The address was empty.

Empty addresses can be claimed. Some addresses are calculated in advance from who creates the code and how many things they have created before. This one was the 13th creation of CreateCall, a public helper tool published by Safe that anyone can use, and that had never been set up on Avalanche. So anyone could set it up, make 12 throwaway creations, and place their own code at number 13. That code would inherit the standing permission.

That is what the thief did. A fresh wallet, funded about 27 minutes earlier with 6.77 AVAX (roughly $60), sent one bundled transaction that built the helper, burned through 12 creations, placed a sweeper program on the empty address and told it to collect all four tokens from the Safe. The permission had sat open for about 233 days.

The bot that got there first

Most blockchain transactions wait briefly in a public queue before they are processed. Bots called MEV bots (MEV stands for maximal extractable value) watch that queue all day, looking for any transaction that would make money and paying extra to jump ahead of it. In stock-market terms, it is like a high-speed trader who sees a large order coming and trades in front of it.

On 26 October one of those bots saw the thief's bundle, worked out that it would pull $7.45 million, made its own identical copy and got it placed first in the same block, at position 0. The thief's transaction landed at position 2 and failed. The money went to the bot instead.

The bot's operator then described itself as a whitehat, crypto's term for a hacker who returns money, and posted a message on the blockchain offering to give the funds back for a reward of 5 to 10%. On 27 October one of the Safe's owner addresses replied on chain: the bot could keep 42,500 AVAX if it returned the rest. That reward is about 5% of the total.

Did it come back?

Yes, according to the blockchain itself. Public records checked by CMZ on 29 October show the bot's holding wallet sent about 3.09 million USDC, 307,835 AVAX, 182 ether and 10.79 bitcoin to the return address between 09:37 and 09:47 UTC on 27 October. Those funds were moved on again that afternoon. The bot's wallet now holds exactly 42,500 AVAX and nothing else of the four tokens, and the Safe's old permissions on Avalanche now read zero. By CMZ's arithmetic, about $7.08 million came back.

Someone also tried to profit from the confusion. Fake USDC and bitcoin tokens were sent around the return address, from an address made to look like it, a trick called address poisoning, aimed at anyone who copies an address from their transaction history without checking every character.

Not a hack of Safe or Avalanche

Nothing in the published analyses points to a flaw in Safe's code or in Avalanche. Both worked exactly as designed. The weak point was a permission the owners granted and never withdrew, on a network where its target did not exist. Neither Safe nor Avalanche has commented on the incident.

It is the second time in six weeks that a bot has beaten a thief to a Safe. In September a different Safe on Ethereum lost about $7.8 million in rsETH through a faulty add-on, and a bot known as Yoink took the money first. The lesson in both cases is the same as for anyone with old direct debits on a bank account: cancel the ones that are no longer needed, because the next person to find them may not give the money back.