ether.fi Legacy AtomicQueue Exploit Drained User Wallets

ether.fi has disclosed a September 11 exploit involving a deprecated Veda AtomicQueue withdrawal helper. The queue’s authorization logic allowed a caller to name another wallet as the paying party without that wallet’s consent, while old ERC-20 approvals enabled transfers from roughly 11 user wallets.

How the legacy queue was abused

According to ether.fi’s incident report, the vulnerable component was a deprecated AtomicQueue withdrawal helper associated with Veda. The queue lacked an authorization check confirming that the wallet named as the paying party had actually approved the withdrawal. A caller could therefore supply another wallet as the source of payment.

The attack also required stale ERC-20 approvals and compatible smart-wallet callback behavior. Once those conditions were present, the queue could use the old approval to move assets from a user wallet. This is different from a compromise of ether.fi’s current Liquid vault accounting or a direct theft of protocol treasury funds.

Incident element	Reported detail
Vulnerable component	Deprecated Veda AtomicQueue withdrawal helper
Root cause	Missing authorization check for the named paying wallet
Additional condition	Old ERC-20 approval and compatible smart-wallet callback behavior
Reported Ethereum loss	About 15.4536 ETH, with realized losses near $40,000
Arbitrum asset	Approximately 2,257 sETHFI
Affected wallets	Roughly 11 user wallets
Response	Queue denylisted, exploit path closed and users promised reimbursement

What assets were affected

ether.fi reported that about 15.4536 ETH was drained from roughly 11 user wallets, along with approximately 2,257 sETHFI on Arbitrum. The company said realized Ethereum losses were about $40,000 and that affected users would be reimbursed.

The company said no vault, treasury, protocol-held assets, eETH, weETH, active Liquid vault accounting or current withdrawal flow was affected. The exposure was limited to wallets that retained the relevant old approval and met the callback conditions. That distinction matters, but it does not make unused approvals harmless. A permission granted to a deprecated contract can remain exploitable long after a user stops using the related interface.

Reported losses and scope may change as affected users reconcile balances and investigators review transactions. Users should rely on the incident report and their own wallet history rather than assuming that an unaffected protocol balance proves every associated approval is safe.

How users should respond

ether.fi advised users to revoke approval to 0xd45884b592e316eb816199615a95c182f75dea07. Wallet owners should verify the contract address through the official incident notice, review token approvals on each relevant chain and revoke permissions from a clean, trusted interface.

Teams should include deprecated queues and migration contracts in approval inventories. Smart-wallet users should also inspect callback permissions, operator roles and contract-specific allowances rather than checking only currently active applications. After an incident, users should review outgoing transfers, rotate credentials if a wallet environment may have been compromised and preserve transaction records for support or reimbursement claims.

Read ether.fi’s official incident report and the readable independent coverage. Follow more crypto security reporting at VORTFLUX.

Readers should verify current information, consider liquidity and legal terms, and evaluate market risks independently before taking action.