Crypto authorizations granted to a contract remain active as long as you don’t withdraw them. From May 5, 2026, attackers exploited this rule. They withdrew approximately 1.42 million dollars from 31 addresses, thanks to authorizations given to a router of the Ekubo protocol. The main victim had granted theirs 158 days earlier, according to the founder of SlowMist.