Mure's MureDistribution proxy on Ethereum was drained in a single transaction on 21 May 2026 after a caller-controlled signer address was passed to SignatureChecker, causing it to fall through to the ERC-1271 path and return true for a forged signature. This authorized transferFrom of 4.85M QUEST tokens pre-approved to the proxy, which sold for ~5.45 ETH (~$11.7K).

Mure’s MureDistribution proxy contract on Ethereum was exploited due to an access control vulnerability in signature validation. The attacker supplied a malicious contract as the “signer source,” causing SignatureChecker to return true and bypass verification. This allowed draining 4.85M QUEST tokens (pre-approved to the proxy) via transferFrom, which were then swapped for ~5.45 ETH (~$11,700) on Uniswap. No user funds or main payment infrastructure were affected; it was a targeted logic flaw in one distribution contract.