Pennysia Swap Exploit Drains Four Wallets as SlowMist Flags Old Approvals

SlowMist told Pennysia users to revoke token-spending permissions after an attacker exploited the project's Ethereum Settlement contract, draining assets from wallets that had previously authorized it. The security firm's public warning landed Nov. 13. Swaps had already been switched off the day before, according to onchain records, with Etherscan's read-contract panel still showing them disabled on Nov. 14.

The Nov. 12 attack transaction moved roughly 5,006 USDC, 0.05 wstETH and 101,000 YUNo.finance (YUNO) tokens out of four addresses. Etherscan's transfer list traces those assets through Settlement and an intermediary contract to the address SlowMist named as the attacker. Those figures cover the cited transaction only — not a verified total for the whole incident.

The root cause, per SlowMist, was an “arbitrary external call” — an attacker-chosen call to another contract — that let the exploiter spend tokens using approvals users had left in place. Settlement isn't a pool holding trading inventory; Pennysia's own docs describe it as a router that pulls the token a user wants to sell and routes trades to outside venues. That distinction matters because an approval doesn't require funds to sit in the contract to stay dangerous.

SlowMist flagged this Ethereum spender as the one to check: 0x3aad97e5a91b8e43b7dc830aceb004307678795e. Anyone who approved that address should review remaining allowances and revoke them using Etherscan's token approval tool. Pausing swaps didn't cancel those permissions. How many wallets still hold live approvals, and how much they cover, hasn't been verified.

Pennysia's status page was still showing “All Systems Operational” and “No incidents reported in the last 14 days” when checked on Nov. 14.