Pennysia Users Urged to Revoke Token Approvals After Exploit

A Nov. 12 exploit of Pennysia's Ethereum Settlement contract moved about 5,006 USDC, 0.05 wstETH and 101,000 YUNo.finance (YUNO) tokens from four addresses, according to Etherscan records cited by blockchain security firm SlowMist.

The public response was direct. On Nov. 13, SlowMist urged Pennysia users to revoke token-spending permissions after the attacker exploited the Settlement contract.

For affected users, the relevant approval already existed. The source links the exploit to wallets that had authorized the contract to spend their tokens. SlowMist's warning puts those permissions at the center of its response.

The Nov. 12 transfers

Etherscan's transfer list shows the assets passing through Settlement and an intermediary contract before reaching the address SlowMist identified as the attacker in the cited transaction.

The transaction included:

• About 5,006 USDC
• 0.05 wstETH
• 101,000 YUNo.finance (YUNO) tokens

The transfer list identifies that route and the assets involved. It does not calculate a final incident-wide loss.

The figures cover one Nov. 12 transaction, involving four addresses. The source does not present them as a verified total across the wider incident. That distinction matters for anyone treating the token amounts as a complete accounting of what the attacker took.

The transfer path also explains why the warning focuses on permissions, not just fund movements. The assets left wallets that had authorized the contract, and the records place the intermediary contract between Settlement and the address labeled as the attacker.

The cited account does not explain the exploit code or name the intermediary contract. It therefore leaves the precise mechanics unresolved. No additional aggregate loss figure appears alongside the transaction data.

The swap shutdown

A separate on-chain transaction disabled swaps later on Nov. 12, placing the shutdown after the attack and before SlowMist's Nov. 13 public warning to users.

By Nov. 14, Etherscan's read-contract panel still showed swaps disabled. The report does not name who sent the disabling transaction.

For users, the shutdown and the approval problem are separate issues. A disabled swap function does not report whether every token approval has been revoked. The warning addresses those permissions directly.

The timing still carries operational weight. The service remained unavailable for swaps in the latest on-chain reading, even as the public response focused on wallet-level cleanup rather than a stated reopening date.

What does this change for Pennysia users?

SlowMist's instruction was to revoke token-spending permissions tied to wallets that had authorized Pennysia, rather than wait for the service to reopen after the attack.

That gives users a concrete action. Revoking the spending permission addresses the access described in the warning. The warning does not say that revocation recovers the transferred assets. The available account does not explain the exploit code or identify a broader recovery program.

Users therefore have a specific task: check the relevant approvals and revoke them. The source places those prior authorizations at the heart of the warning because the affected wallets had already granted spending permission.

For Pennysia, the next task is to restore swaps without leaving the previously exploited approval path in place. That is a security condition, not merely an uptime issue. SlowMist's recommendation gives users a way to limit exposure, but it does not supply a broader loss estimate or a reopening schedule.

The cited records offer a narrower measure than a final incident tally: the assets in one transaction, the route they took and the state of the swap function. What they do not establish is the full amount taken across the incident.

With no restoration deadline specified, the next checkpoint is whether users revoke outstanding approvals and whether Pennysia re-enables swaps after the service remained disabled on Nov. 14.