AlpsCon.ai exploited for $152K on BNB Chain via whitelisted Hardhat test wallet with publicly known private key left in the system for 14 months.
Security & Exploits ·
AlpsCon.ai, an AI trading service on BNB Chain, suffered an exploit that drained approximately $152,000 in value. The protocol allows users to stake ALPS tokens to earn USDC rewards generated from its trading activities, but restricts participation to KYC-whitelisted wallets. An attacker exploited a configuration error: a Hardhat test wallet with a publicly known private key—Hardhat/Anvil default account #0—had been added to the whitelist during a bulk import on August 24, 2025, and remained there for roughly 14 months.
The attacker leveraged the test wallet's known credentials to execute an EIP-7702 delegation, allowing them to run exploit code under that whitelisted identity. They flash-loaned 1.03 million USDC, purchased ALPS tokens, and deposited them into a legacy hub contract that still accepted stakes. Critically, the newer reward distribution contract treated this fresh deposit as if it had accrued rewards since inception, disbursing the full historical reward allocation: approximately $355,000 in USDC from the main reward pool. The attacker then unwound the position by unstaking, selling the ALPS back, and repaying the flash loan, realizing a net gain of $152,000.
The deployer removed the compromised address from the whitelist on October 18, 2026, roughly five hours after the attack occurred. The mechanism by which the protocol's reward contracts failed to validate deposit timing—allowing newly staked assets to claim retroactive rewards—remains the core vulnerability that enabled the exploit to succeed.