AlpsCon AI Trade Hub Exploited for $152,809 on BSC
AlpsCon AI Trade Hub was exploited, resulting in a loss of approximately $152,809. The attacker utilized a known private key and a reward accounting bug to execute the exploit.
AlpsCon AI Trade Hub on BNB Chain experienced an exploitation incident where an attacker leveraged the publicly known private key of a Hardhat default test account. This account had been on the KYC whitelist for around 14 months. The attacker executed code via EIP-7702 and utilized a flash loan of USDC to purchase and stake ALPS tokens.
The exploitation involved a reward accounting bug, where the system incorrectly treated a fresh stake as historical, allowing the attacker to claim accumulated rewards. After repaying the flash loan, the attacker netted approximately $152,809 in USDC.
This incident highlights vulnerabilities in the handling of private keys and reward mechanisms within the platform. The use of the BSC chain means that all transactions related to this exploit can be traced on-chain, providing a record of the activities associated with the addresses involved.