this guy facedoxxed onchain and rugged the @zora airdrop allocation intended for @0xproject 

wild!

To clarify - 0x Settler contract was not exploited.

The attackers took advantage of the fact that ZORA tokens were allocated to the contract (which is permissionless and allows arbitrary calls) and were able to use it to claim it's ZORA balance.

Interesting tidbit - In this TX: https://t.co/PWd5awtLtV

The attacker moved funds to 0xf70da97812cb96acdf810712aa562db8dfa3dbef

Which is funded by 0x13c796afaabbab309047f8695e5b3e868794ae90

which can be traced to this Farcaster account:
https://t.co/9afGuAO5Pv

👀

Blockaid

Embed swaps in your onchain app. Access 10+ million tokens with liquidity from 150+ exchanges with a single API.

https://linktr.ee/0x.org

this guy facedoxxed onchain and rugged the @zora airdrop allocation intended for @0xproject 

wild! 

https://x.com/blockaid_/status/1915435995660460291

I mean is it an exploit really? It was all intended functionality. The 0x team wrote the contracts to work like this