AlpsCon AI Trade Hub on BNB Chain drained of about $152k via whitelisted Hardhat test key and reward-accounting bug

Summary

AlpsCon's AI Trade Hub reward/staking contract on BNB Chain was exploited for about $152.8k in USDC. Per the analysis cited below, the attacker controlled the Hardhat/Anvil default account #0, whose private key is public, which had stayed on the hub's KYC whitelist for about 14 months. Using EIP-7702 to run code from that account, the attacker flash-loaned USDC, bought and staked ALPS, and claimed rewards that a new stake should not have been entitled to.

Incident

• Victim: AlpsCon AI Trade Hub (reward contracts V7-V9), BNB Chain
• Date (UTC): 2026-10-18/19. SlowMist Hacked lists 2026-10-18, DefiLlama lists 2026-10-19, and the write-up below says the whitelist entry was removed at 11:40 UTC on 2026-10-18, about five hours after the attack. Sources disagree on the exact date.
• Loss: 152,809 USDC per ExVul (as cited by Rekt Radar); SlowMist Hacked and DefiLlama both record about $152.8k
• Attack type: access-control failure (public test key whitelisted in production) combined with reward-accounting error
• No fix or official statement from AlpsCon observed at time of publication

Impact

Per the analysis, reward contracts V7-V9 imported balances from earlier versions and applied the accumulated profit-per-share to a fresh stake whose entry profit-per-share was zero, letting a new stake claim earlier distributions. With about 1.03M USDC flash-loaned, the attacker took roughly $355k in rewards before repaying, netting about $152k. Exploitation is confirmed on-chain by the reporting sources.

Recommended actions

• AlpsCon users: do not stake in or approve the AI Trade Hub contracts until AlpsCon publishes a post-mortem and fix.
• All projects: remove well-known development accounts (Hardhat/Anvil/Ganache default keys) from production allowlists, roles and multisigs. Since EIP-7702, anyone holding a public key can run arbitrary code as that account.
• Staking/reward contract authors: initialise a new stake's reward debt to the current accumulator, especially when migrating balances between contract versions.

Indicators

None published by 0xCERT yet. Attacker addresses have only been seen relayed second-hand and will be added once verified against the primary security-firm alerts.

Source & attribution

This 0xCERT advisory summarises the incident analysis by Jacobo Avariento on Rekt Radar (https://www.rektradar.xyz/web3-daily-exploits-19-oct-2026-alpscon-152k-hardhat-eip7702/), which cites detection by Defimon Alerts (https://x.com/DefimonAlerts/status/2112102178026308045) and a technical breakdown by ExVul (https://x.com/exvulsec/status/2112118384464892127). It is corroborated by SlowMist Hacked (https://hacked.slowmist.io/) and DefiLlama (https://defillama.com/hacks). Details may change; refer to the original sources for the authoritative record.