-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0260 ============================================================ Advisory-ID: 0xCERT-2026-0260 Severity: Medium Published: 2026-10-19T00:00:00.000Z Updated: 2026-10-22T07:23:32.264Z Chains: BNB Chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0260 Title: AlpsCon AI Trade Hub on BNB Chain drained of about $152k via whitelisted Hardhat test key and reward-accounting bug Summary - ------- An attacker drained about $152.8k USDC from AlpsCon's AI Trade Hub staking contract on BNB Chain on 18-19 Oct 2026, combining a still-whitelisted Hardhat default account (public key) with a reward-accounting flaw. Projects should purge test accounts from production allowlists. Details - ------- Summary AlpsCon's AI Trade Hub reward/staking contract on BNB Chain was exploited for about $152.8k in USDC. Per the analysis cited below, the attacker controlled the Hardhat/Anvil default account #0, whose private key is public, which had stayed on the hub's KYC whitelist for about 14 months. Using EIP-7702 to run code from that account, the attacker flash-loaned USDC, bought and staked ALPS, and claimed rewards that a new stake should not have been entitled to. Incident - - Victim: AlpsCon AI Trade Hub (reward contracts V7-V9), BNB Chain - - Date (UTC): 2026-10-18/19. SlowMist Hacked lists 2026-10-18, DefiLlama lists 2026-10-19, and the write-up below says the whitelist entry was removed at 11:40 UTC on 2026-10-18, about five hours after the attack. Sources disagree on the exact date. - - Loss: 152,809 USDC per ExVul (as cited by Rekt Radar); SlowMist Hacked and DefiLlama both record about $152.8k - - Attack type: access-control failure (public test key whitelisted in production) combined with reward-accounting error - - No fix or official statement from AlpsCon observed at time of publication Impact Per the analysis, reward contracts V7-V9 imported balances from earlier versions and applied the accumulated profit-per-share to a fresh stake whose entry profit-per-share was zero, letting a new stake claim earlier distributions. With about 1.03M USDC flash-loaned, the attacker took roughly $355k in rewards before repaying, netting about $152k. Exploitation is confirmed on-chain by the reporting sources. Recommended actions - - AlpsCon users: do not stake in or approve the AI Trade Hub contracts until AlpsCon publishes a post-mortem and fix. - - All projects: remove well-known development accounts (Hardhat/Anvil/Ganache default keys) from production allowlists, roles and multisigs. Since EIP-7702, anyone holding a public key can run arbitrary code as that account. - - Staking/reward contract authors: initialise a new stake's reward debt to the current accumulator, especially when migrating balances between contract versions. Indicators None published by 0xCERT yet. Attacker addresses have only been seen relayed second-hand and will be added once verified against the primary security-firm alerts. Source & attribution This 0xCERT advisory summarises the incident analysis by Jacobo Avariento on Rekt Radar (https://www.rektradar.xyz/web3-daily-exploits-19-oct-2026-alpscon-152k-hardhat-eip7702/), which cites detection by Defimon Alerts (https://x.com/DefimonAlerts/status/2112102178026308045) and a technical breakdown by ExVul (https://x.com/exvulsec/status/2112118384464892127). It is corroborated by SlowMist Hacked (https://hacked.slowmist.io/) and DefiLlama (https://defillama.com/hacks). Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://www.rektradar.xyz/web3-daily-exploits-19-oct-2026-alpscon-152k-hardhat-eip7702/ - - https://x.com/exvulsec/status/2112118384464892127 - - https://x.com/DefimonAlerts/status/2112102178026308045 - - https://hacked.slowmist.io/ - - https://defillama.com/hacks - - https://www.blockchainbreaches.com/en/breaches/alpscon-2026 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmroJzAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmd+qxXzE5yXlP6PC62FgcaXhiQTi/aQW5FwJn2C 8mlKoBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACtowD+NI6O9/b1XZ8IAvhN DWrfQFmxrLKj8NBZkrWK9HhpX0UA/ilJpa02F/FrzbPuNnR6neorPMTaSj4Q kykx/PBrsMYF =jLAK -----END PGP SIGNATURE-----