On January 1, 2026, attacker exploited PRXVT staking contract on Base via Sybil attack; deployed numerous CREATE2 addresses to bypass per-address limits and farm rewards, draining 32.8 ETH (~$97K). No cost/identity constraints protected the per-address logic.

PRXVT staking contract was exploited on January 1, 2026, via a Sybil Attack using CREATE2 addresses. The attacker drained approximately $97K from the protocol.