AlpsCon AI Trade Hub’s V7–V9 contracts incorrectly applied accumulated historical profit-per-share values to balances imported from preceding versions, allowing newly deposited funds to claim rewards accrued before the deposits existed. The attacker used a flash loan to create temporary ALPS service credits and exploited the accounting flaw to extract USDC. The attack was facilitated by an authorization whitelist containing a publicly known Hardhat test account, which the attacker used through EIP-7702 delegation

AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.