On September 13, 2025 Kame Aggregator on the Sei network was exploited due to missing validation in the swap() function that allowed arbitrary executor calls, affecting 830 users who had granted unlimited token spend permissions to Kame contracts and draining approximately $1.325 million in total value.

Kame Aggregator suffered an exploit due to a design flaw in the swap() function, which allowed arbitrary executor calls. This vulnerability enabled attackers to transfer tokens authorized to the AggregationRouter by users, particularly those with unlimited or oversized approvals. The total value of affected assets was approximately $1.32 million, of which around $946,000 was recovered by the Kame team from the primary exploiter, and about $22,000 was recovered by white-hat hackers.