In December 2025, attacker exploited FutureSwap on Arbitrum using flash loans to acquire temporary governance voting power and pass a malicious proposal transferring protocol funds.

According to monitoring by SlowMist’s MistEye security monitoring system, potential suspicious activities related to @futureswapx have been detected. Further analysis indicates that the root cause lies in an attacker creating a malicious proposal and leveraging flash loans to vote, ultimately granting privileges to the attack contract and enabling it to transfer tokens from other users.