The $47 Million Problem Everyone Ignored
On the surface, every Optimism wallet user appears to have Ethereum's security model. But it's an expensive assumption that has proven to be especially costly for Layer 2 users. Wallet exploits against Optimism users have drained roughly $47 million into OP addresses over the course of 2025 and early 2026, per on-chain forensics data aggregated by a number of blockchain security firms.
Optimism news coverage on these topics has not been extensive or vocal. But this is partially a function of people simply not yet understanding what crypto security and risk really looks like when it is outside a "news cycle" and based on looking at chain data over longer timeframes. Not the big headline stories, though certainly very real.
Not zero-days. Approval scams, bridge interactions with a phishing interface on the other end, and legacy contract approvals signed by users years or months earlier but long since forgotten. And the Optimism price from $4.84 to around $0.11 (down 97.7%). The particular mechanics of those security gaps bleeding retail Optimism users dry hasn't had anywhere near comparable visibility or due diligence across a userbase unfamiliar with how L2 rollups handle batching, withdrawal queues, and cross-chain messaging. The takeaway is less that it was one big hack. But thousands of little ones that add up to it. There is an attack surface, and lots of wallets containing funds are within it.
Where Most Optimism Wallets Actually Get Compromised
The most common attack vector on Optimism crypto wallets doesn't start with a private key. It starts with an unbounded token approval. By default, if a user adds Optimism as a network to MetaMask, then visits a dApp on OP Mainnet, the very first transaction they sign is an ERC-20 approval. That approval is what allows that dApp's smart contract to "spend" tokens on their behalf.
This is the same situation on Ethereum mainnet, but "gas friction" mitigates the issue by disincentivizing people from storing as many approvals in the first place. On Optimism, where gas fees can be fractions of a cent, the same incentives don't apply and people just do way more contracts and don't think twice about signing approvals.
Forta Network researchers documented in a blog post that they've witnessed over 12,000 wallets on Optimism during Q4 2025 with active, unlimited approvals to contracts that were later deemed malicious or compromised. Same story. User uses yield aggregator they believe is legit, signs unlimited approval and walks away. Weeks or months later, the admin key to that contract is compromised (or was malicious to begin with) and attacker sweeps all tokens for which that approval was granted.
Explorer Optimist shows these drain transactions in hindsight, but almost no one is monitoring approvals proactively. RevK tool supports Optimism, but less than 3% of all active Optimism wallet addresses appear to have used a revocation tool ever. That disconnect between the tools that address this risk and actual user behavior is where the losses are now concentrated. The approval problem funnels directly into another, broader, more foundational asset-transfer flaw.
The Bridge Approval Trap Explained
The Optimism bridge is the primary bridge for most cross-chain asset transfers between Ethereum L1 and OP Mainnet (or vice versa). The bridge is based on Optimism's fraud-proof system and there is currently a 7-day challenge period enforced for all withdrawals to L1.
The withdrawal waiting period creates a security dynamic that most users don't really understand. The funds during that withdrawal waiting period are in a pending state on L1. But if a user had signed blanket approvals on L1 contracts before bridging, that money is now in the clear to be targeted before it's actually claimable. Attackers are simply front-running the finalization step. The 7-day window intended to allow for fraud proofs to be submitted becomes a 7-day exposure window for any user with outstanding L1 approvals to the bridge recipient address.
Optimism is working with Succinct to integrate zero-knowledge proofs that would remove the waiting period altogether via cryptographic validity proofs instead of fraud proofs. If that upgrade goes live, it shrinks the withdrawal window to minutes or less. For the time being, every single user who bridges back to L1 has to live with this temporal risk. Bridges provided by third parties like Hop or Across can front-load withdrawal speed by providing liquidity up front, but those wallets then become vectors for approval surface area and smart contract risk of their own.
Users who add Optimism to MetaMask and start immediately bridging assets without consideration of the process are often unaware they're layering approval risk across two chains and several contracts in a single session. Airdrop season in 2022 primed many hundreds of thousands of wallets to aggressively interact with Optimism ecosystem contracts (eligibility rewarded from breadth of activity). Many of those wallets still have approvals left over from 2 or 3 years ago sitting there unused, but vulnerable. Dune Analytics dashboard tracking OP wallet hygiene shows roughly 40% of wallets that got the Optimism airdrop have one or more active approvals to a contract that has since been flagged or abandoned.
Security Steps Most Optimism Users Skip
The first security hygiene step is approval auditing. Users should be reviewing their active token approvals on Optimism at least monthly. They can do this through Optimism explorer or a third-party tool like Revoke.cash. The cost to revoke approvals is fractions of a cent on OP Mainnet. There is no economic disincentive. The barrier is awareness.
Second: isolation between addresses and chains. Optimism users that care about the value should be using separate wallets for bridging vs. DeFi vs. long-term storage. A wallet that has been used to add Optimism to MetaMask and then went on to interact with 20+ dApps has a materially different risk profile than one that's been used solely for receiving transfers. Institutional desks take the same opsec for granted on every chain.
Third: verify contract addresses before you sign any transaction. Phishing sites and dApp imposters have had near industry-wide success in lifting the Optimism brand's look and feel to a high degree of fidelity. Fake bridge interfaces featuring the Optimism logo have been one of the more consistent attack vectors on Optimism in 2025 into 2026. Bookmark official URLs and contract addresses and then always compare with Optimism's docs page to rule out that most basic phishing attack vector.
Low-level stuff. Stuff that 99.9% of Optimism wallet users are just not doing, if you can judge it by on-chain data.
L2-Specific Risks Hardware Wallets Don't Cover
Ledger or Trezor will happily sign an infinite token approval if you approve it, and that signed approval is just as exploitable on Optimism as it would be if signed by a software wallet. The caveat is that the L2-specific UX on Ledger or Trezor doesn't usually parse out the transaction data of an Optimism transaction in as user-friendly a way as it does for L1 Ethereum transactions. Blind signing, full confirmations with no real visibility of what you're signing is a prevalent practice with OP users when sending to newer OP Mainnet contracts that don't yet exist on Ledger or Trezor verification lists.
You get a hex string, approve it, and then cross your fingers that the dApp frontend is indeed displaying the transaction you're signing accurately. UX trust model is defeated if the frontend dApp is hijacked or spoofed. Exactly the type of attack vector that hardware wallets are supposed to protect you from.
Why This Matters More Than Optimism Price
Optimism's current trade volume is in the ballpark of 450K trades a day as of early 2025 (and volume is up from then). That means there's a large and growing attack surface to be exploited. Optimism coin being at deeply depressed levels may disincentivize certain potential exploit attempts, but the $1.84B in TVL on OP Mainnet alone (source: L2beat) shows otherwise. Real dollars being held by wallets with poor approval hygiene and non-secure bridge practices.
There was some deservedly focused attention on token buyback mechanics, and what a deeply depressed Optimism price does for that ecosystem in 2026. Those are material stories for sure. But the more proximate and actual threat to everyday users' funds holding OP tokens or DeFi positions on Optimism is the open-ended approval the user signed 9 months prior to a contract they couldn't even recall ever interacting with.
Across the L2 ecosystem as a whole (regardless whether you follow Algorand news, Optimism news, or any other ecosystem in between), wallet security is the weakest link between a protocol's technical soundness and real-world security outcomes. Out of 82K daily active addresses on OP Mainnet, how many have even once audited their approvals?
