POPA ReconAlpsCon.ai hacked $152K
AlpsCon.ai hacked $152K Rootcause: Access-control / operational failure (the entry point) The Hardhat/Anvil default account #0 (0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266) — whose private key is publicly known — was added to the production KYC whitelist in a bulk import on 2025-08-24 and left there for ~14 months. Anyone could therefore use EIP-7702 to delegate arbitrary code to that address and execute transactions as a fully verified, whitelisted wallet. Reward-accounting bug (the actual value extraction) Newer reward contracts (V7–V9) recursively imported balances from earlier versions.…
The excerpt is quoted from a public Telegram channel, which owns its text.
Read the original post on Telegram