DAOstack exploit (2026-09-26) — attacker addresses
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Reported: 2026-10-15
- Last updated: 2026-10-16
DAOstack exploit on EVM, 2026-09-26. DeFiHackLabs summary: DAOstack - permissionless newOrganization lets an attacker hijack an existing Reputation contract and drain the Avatar. Loss as recorded by DeFiHackLabs: 4.025 ETH (full Genesis Alpha treasury); attacker minted 20,000 REP against the victim's real Reputation contract (supply 9,738.6 to 29,738.6, ~67% majority after a 200 REP GenesisProtocol vote-cost b. Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract =…