0x46f54c1a86575679fc3d29666c1717e9786279aa

Gasless Reservoir Enabler exploit (2026-09-21) — attacker addresses

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

Gasless Reservoir Enabler exploit on EVM, 2026-09-21. DeFiHackLabs summary: GaslessReservoirEnabler - erc20WithTransfersAndExecute lets a whitelisted module run unvalidated transferFrom calldata. Loss as recorded by DeFiHackLabs: 8.72 WETH (~$23.8K) across 466 victims with standing approvals to the Enabler; PoC reproduces 3 victims, 2.3546 WETH (~$6.4K, ~27% of the WETH-leg loss). Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the…

GaslessReservoirEnabler exploit (2026-09-21) — attacker addresses (Blackpaper BP-1298)

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

GaslessReservoirEnabler incident on 2026-09-21 15:34 UTC (Token Approval Abuse). An attacker used Polygon's GaslessReservoirEnabler to take WETH and ZED from 997 unique wallets via their standing allowances, reported value about $23,000. Source: Blackpaper BP-1298 (https://blackpaper.wiki/incident/BP-1298/), in-house verified record. This report lists only the addresses Blackpaper places under its Attacker addresses section; no victim wallets are included: - 0x46f54c1a86575679fc3d29666c1717e9786279aa (Polygon · Actor EOA; deployed and operated the batch helper, then received the WETH sweep) -…

Other addresses in this report: 0x26a3d1f28de682f116744a5f026848dc0d7862eb