ACP token drained from NodePurchase contract in 12.2M token exploit; operator requesting white-hat bounty return.
Security & Exploits ·
Approximately 12.2 million ACP tokens were transferred from the NodePurchase contract on October 28, 2026, according to an onchain message. The operator of the contract claims responsibility for the transaction and states they can verify ownership via the admin address, framing the movement as an incident rather than an unauthorized breach.
The tokens were moved from the NodePurchase contract address into a separate holding address on Ethereum mainnet. The operator has publicly requested the return of the funds and indicated willingness to negotiate a white-hat bounty as incentive for recovery, providing an email contact for discussions.
The claim of operator status and the framing as a recoverable incident remain unverified by independent sources at this time. The circumstances that led to the token movement and whether the described white-hat recovery process has progressed are not yet documented in available reporting.