WBTC Approval Drain Routed Through Ekubo Flash Accounting

On May 5, 2026, an Ethereum victim lost 17 WBTC after a malicious callback contract routed through Ekubo flash-accounting calls to consume a pre-existing unlimited WBTC allowance.