AlpsCon AI Trade Hub hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 18, 2026 |
| Target type | Other |
| Loss | $152,295Price at time of incident |
| Method | Contract logic errorEach reward hub version imported the previous version’s balances and paid claims against its accumulated reward-per-share while a fresh stake’s entry point was still zero, so a new flash-funded stake was credited the full reward history. Reward gates were passed through a whitelisted account whose private key is public: Hardhat’s default test account |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
An attacker drained about $152,000 in USDC from the reward pools of AlpsCon AI Trade Hub, a staking and reward contract system on BNB Chain, in a single transaction at 06:34:55 UTC on 18 October 2026. This registry read the transaction: the attacker’s address received 152,295.36 USDC.
According to the DeFiHackLabs reconstruction, the hub still trusted the canonical Hardhat default account on its verified-caller whitelist, and that account’s private key is public. The attacker used an EIP-7702 authorisation signed with the known key to point the account at its own code and pass every reward gate. Each reward hub version imports the previous version’s balances through migrate() and then pays claims against the version’s accumulated reward-per-share, while a new deposit’s entry point is still zero. The attacker flash-borrowed 1,027,990 USDC from Aave, bought and staked ALPS in the still-open V6 hub, carried the stake forward, over-claimed rewards from the V7, V8 and V9 hubs, then unstaked, sold the ALPS and repaid the loan.
AlpsCon has not made a public statement that this registry could find, and nothing has been reported as returned.
Sources
- BNB Chain exploit transaction, read by this registryOn-chain · retrieved 2026-10-21
- DeFiHackLabs, proof of concept and analysisSecondary · retrieved 2026-10-21
- DefiLlama hacks databaseAggregator · retrieved 2026-10-21
Changes to this entry
- Recorded from DeFiHackLabs’ reconstruction, checked against our own read of the transaction receipt.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "AlpsCon AI Trade Hub hack — October 2026", iTokenly, accessed 2026-10-21, https://itokenly.com/hacks/alpscon-ai-trade-hub-october-2026https://itokenly.com/hacks/alpscon-ai-trade-hub-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.