Blockchain security firm Blockaid flagged an active smart contract exploit draining $132,700 from ShapeShift’s FOX Colony on Arbitrum.
- The attacker targeted the executeMetaTransaction function in FOX Colony’s contracts, using a delegate call to redirect funds to a malicious contract.
- A second related exploit drained an additional $50,000 shortly after the initial attack, bringing total losses to approximately $182,700.
- Blockaid warned every Colony Network deployment exposing executeMetaTransaction on top of EtherRouter, across any chain, may face the same vector.
Blockaid flagged the incident on X on May 13, identifying the attacker wallet at 0xeed236Afb6967f74099a0a6bf078BC6b865fbf28. FOX Colony is ShapeShift’s community governance and participation programme, allowing FOX token holders to stake, vote, and engage in ecosystem activities through Colony Network contracts on Arbitrum.
根据Blockaid的分析，该漏洞位于executeMetaTransaction函数中。 The attacker meta-signed a targeted transaction, repointed the colony’s resolver to a malicious contract, and then used a delegate call to drain the funds.
Because any external address can call the affected registration function without permission modifiers, the flaw is effectively equivalent to making a copy of the protocol’s key available to any attacker who finds it.
为什么其他 Colony Network 协议仍然面临风险
Blockaid alerted the broader DeFi community that every Colony Network colony exposing executeMetaTransaction on top of EtherRouter, across any chain, shares the same potential attack surface.截至撰写本文时，ShapeShift 尚未就该漏洞发布公开声明。
The warning continues a difficult run for DeFi security in 2026. Blockaid previously flagged a $5 million exploit on Wasabi Protocol across Ethereum and Base in April, where a compromised admin key was used to drain multiple vault contracts.
Earlier in May, Blockaid identified a $6.7 million exploit on TrustedVolumes, a DeFi liquidity provider serving 1inch and other aggregators. 2026 年 4 月是有记录以来 DeFi 漏洞利用最严重的一个月，28 起独立事件造成约 6.25 亿美元损失。
The firm also warned CoW Swap users in April of a frontend hijack where attackers compromised the project’s site to serve malicious transaction prompts. Blockaid screens over 500 million blockchain transactions per month and provides security infrastructure to Coinbase, MetaMask, Uniswap, and OKX.