Pennysia Exploit Drains Four Addresses, Users Told to Revoke Approvals

The notable detail here is the sequence: swaps were halted before a public security warning went out, which suggests the team had some advance visibility into the drain rather than learning of it from the community. That matters less for the four affected addresses than for the broader pattern of approval-based exploits, where the damage is often done before any pause can help. The open question is whether the exposure is limited to those four addresses or whether other users granted similar approvals that have not yet been exercised.