Pennysia Settlement contract on Ethereum exploited via arbitrary external call to drain leftover token approvals

Summary

SlowMist reports that Pennysia's Settlement contract on Ethereum was exploited through an arbitrary external call, which let the attacker spend users' leftover ERC-20 approvals to that contract. SlowMist says it investigated after users reported stolen funds. DefiLlama's hacks dataset records the incident on 12-13 November 2026 with about $5,131 taken from four users (USDC, wstETH and YUNO).

Affected

• Pennysia Settlement contract on Ethereum: 0x3aad97e5a91b8e43b7dc830aceb004307678795e (the vulnerable protocol contract, listed so users can revoke approvals; it is not an attacker indicator)
• Any wallet that has ever approved tokens to that contract
• Fix: none announced at time of publication

Impact

Per SlowMist, an attacker can use the arbitrary external call in the Settlement contract to transfer tokens out of any wallet that still has an allowance to it. Per DefiLlama, the attacker deployed malicious tokens to get past spending checks in executeSwap() and then used existing allowances to pull USDC, wstETH and YUNO directly from users' wallets. Exploitation in the wild is confirmed. Losses reported so far are small (about $5.1K), but any approval left in place is still exposed until it is revoked.

Recommended actions

• Revoke every token approval granted to 0x3aad97e5a91b8e43b7dc830aceb004307678795e on Ethereum now (for example with revoke.cash or Etherscan's token approval checker).
• Wallets and security tools: block the attacker address listed below and warn users who sign approvals to the Settlement contract.
• Wait for Pennysia's official post-mortem before interacting with the protocol again.

Source & attribution

This 0xCERT advisory summarises a SlowMist TI Alert (https://x.com/SlowMist_Team/status/2121135351377047735), which names the attacker address and attack transaction, corroborated by DefiLlama's hacks dataset (https://defillama.com/hacks). Details may change; refer to the original source for the authoritative record.