Dolomite Hack: $1.8M Approval Exploit

What happened

On March 20, 2024, users of Dolomite were drained of approximately $1.8M — not through the live protocol, but through a deprecated Dolomite contract dating back to 2019. The old contract's callFunction mechanism could be abused to move tokens on behalf of any user who still had an active approval to it. Users who had interacted with Dolomite years earlier and never revoked those ancient allowances found their wallets drained on Ethereum mainnet, where the legacy contracts remained live; the current Arbitrum deployment was unaffected. The team publicly urged users to revoke approvals to the legacy contract. The case is a textbook reminder that token approvals are indefinite: a contract deprecated five years earlier remained a live attack surface. The graph that stood on this row until September 30, 2026 was built from an address public reporting does not name as the exploiter, and most of its transfers predated the theft, so it was withdrawn rather than relabelled; a re-trace on October 8, 2026 put a new one there, and its first traced movement falls on the day of the theft rather than weeks after it. This page still states no figure, no endpoint and no address of its own from that graph — the record here carries no attacker address for this incident, and everything above rests on public reporting alone.