Security firm SlowMist reported that the Pennysia protocol was exploited through outdated token approvals, resulting in wallet drains from four addresses. Users have been urged to immediately revoke permissions granted to the affected contracts. Although Pennysia disabled swaps prior to the public warning, the pause does not automatically cancel existing token approvals, leaving wallets vulnerable until permissions are manually revoked.