[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]

[@guardrailai](/creator/twitter/guardrailai)
"The root issue was in SwapLogic._swapViaRouter(): The assumption: router would always be a legitimate DEX (Uniswap 1inch) The reality: the attacker registered their own contract as both the router AND the whitelisted Arcadia account"  
![@guardrailai Avatar](https://lunarcrush.com/gi/w:16/cr:twitter::1641820305923481603.png) [@guardrailai](/creator/x/guardrailai) on [X](/post/tweet/1948780487230566919) 2025-07-25 16:20:49 UTC XXX followers, XX engagements


"Step 1: The attacker first took flash loan & did account setup Step 2: Through repay health checks were bypassed Step 3: Changed the router address via injection Step 4: Access control were bypassed Step 5: Drainage of funds from victims account"  
![@guardrailai Avatar](https://lunarcrush.com/gi/w:16/cr:twitter::1641820305923481603.png) [@guardrailai](/creator/x/guardrailai) on [X](/post/tweet/1948780484705595556) 2025-07-25 16:20:48 UTC XXX followers, XX engagements