A trading team gave a contract unlimited access to $7.45M on Avalanche. The contract didn't exist there.
Back in March, the team's 2-of-7 Safe approved unlimited WAVAX, USDC, WETH.e and BTC.b spending to an address that holds their pool on Ethereum, Base and Arbitrum. On Avalanche it was empty, and it happened to be the address Safe's public CreateCall factory produces on its 13th deployment.
On Oct. 26 someone ran 12 throwaway deployments and parked a sweeper on number 13. An MEV bot copied the move and beat it in the same block, then declared itself a whitehat. Per Defimon, the owners offered it 42,500 WAVAX, about $371K, to send the rest back.
Same address, different chain, different tenant. Revoke the approvals, especially the ones pointing at nobody.