AlpsCon exploit via whitelisted Hardhat test key

About $152K net, per Defimon (about $355K USDC paid from the reward pool before the flash loan was repaid).

Root cause: Per Defimon: the KYC whitelist included Hardhat/Anvil default account #0 (0xf39f…2266), whose private key is public; an older hub contract still accepted stakes that newer reward contracts credited with the full reward history.

Timeline, as sourced: Test account whitelisted 24 Aug 2025 04:26 UTC; exploit tx 18 Oct 2026 06:34:55 UTC; address removed 18 Oct 11:40:31 UTC (on-chain).

AlpsCon runs a staking service on BNB Chain in which only KYC-whitelisted wallets can stake ALPS and claim USDC rewards. According to Defimon (opens in a new tab), the whitelist included Hardhat/Anvil default account #0, a test wallet whose private key is published, added in a bulk import on 24 August 2025 (opens in a new tab). On 18 October 2026 the attacker signed an EIP-7702 delegation with that key and ran its exploit as the whitelisted wallet (transaction (opens in a new tab)). Per Defimon, it flash-loaned 1.03M USDC, bought and staked ALPS in an older hub contract that still took deposits, and newer reward contracts paid the full reward history on the fresh stake, about $355K USDC. After repaying the loan the attacker netted about $152K, Defimon says. The deployer removed the address (opens in a new tab) about five hours later. Test accounts with published keys belong nowhere near a production allowlist.