AlpsCon AI Trade Hub
Oct 19, 2026
AlpsCon AI Trade Hub’s V7–V9 contracts incorrectly applied accumulated historical profit-per-share values to balances imported from preceding versions, allowing newly deposited funds to claim rewards accrued before the deposits existed. The attacker used a flash loan to create temporary ALPS service credits and exploited the accounting flaw to extract USDC.
The attack was facilitated by an authorization whitelist containing a publicly known Hardhat test account, which the attacker used through EIP-7702 delegation.
How the exploit worked
View reproducible PoC3625 USDC net gain.
Lost: ~152.8K USDC drained from the AlpsCon AI Trade Hub reward pools on BNB Chain; the attacker EOA received 152,295.3625 USDC before gas, with the Aave flash loa…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Incorrect Share Accounting
- Attribution
- Unknown
- Chains
Event timeline
- Oct 19, 2026Exploit executed — $153K drained via incorrect share accounting
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)