This EVM (Ethereum, BNB Chain, Base and other EVM chains) address was named in 2 public crypto scam reports: Hack. First reported 2026-10-25. Last updated 2026-10-25.

Yapeswap governance attack (2026-10-25) follow-up: second drain tx, ~$24.8k total, fake registry and 5 vaults, 10.52 ETH unmoved

Scam type: Hack
Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
Project or site name: Yapeswap
Incident date: 2026-10-25
Reported: 2026-10-25
Last updated: 2026-10-25

Follow-up to our report on the Yapeswap governance attack on Ethereum (https://blockint.ai/c3?report=393d3dec-3cd1-445e-8a9b-22a2e81189b7). This report adds a second drain transaction, the assets taken, the attacker's malicious registry and five fake vaults, where the funds went, and how the attacker wallet 0x6e523866424220b3cb2cab88ba2195cfa5636b12 was first funded. Attack setup: https://etherscan.io/tx/0xb6f85a1bff5222cceace7026955b5aaae311b94c63bf0a7dc0719f0f49317af9 (block 26,266,649, Oct 24 9:18:35 PM CT), sent by 0x6e523866424220b3cb2cab88ba2195cfa5636b12, deployed the exploit contract…

Other addresses in this report: 0x327bf6dfc38a79393f78866c705193c39b04be01, 0xc620ca5b2a63cdb792d462898010d2be4421b5a7, 0x5ec9e34b7bdce9f79e538c0e318a30c6a184fd10, 0x27a8ab7bec76a6ccc929c3f24e4640b5978a3ebb, 0xde161e9e2b6e94ac9ea86357cadfaa02dc38501a, 0x2190426f21d4d70f78779aedb4b993728c341b78, 0x6f88eca5e7922ec0a0ed16f8d9199f68e0120d9c

Linked reports: Yapeswap governance attack on Ethereum (2026-10-25): zero-quorum vote handed YapeFactory's feeToSetter role to attacker, ~$21.9k lost

Yapeswap governance attack on Ethereum (2026-10-25): zero-quorum vote handed YapeFactory's feeToSetter role to attacker, ~$21.9k lost

Scam type: Hack
Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
Project or site name: Yapeswap
Incident date: 2026-10-25
Reported: 2026-10-25
Last updated: 2026-10-25

SlowMist reported on X on 2026-10-25 (4:36 AM CT) that Yapeswap lost about $21.9k in a governance attack on Ethereum. Per SlowMist, WorkersUnion's zero quorum let a proposal backed by about 0.000055% of voting power transfer YapeFactory's feeToSetter role to the attacker. The attacker then installed a Registry that returned fake vaults from latestVault() while vaults() still listed the real ones, so YapePair contracts counted diverted deposits as farming assets without receiving redeemable shares. SlowMist lists YapeFactory / YapePair / YapeWrapper (0x46adc1…35a2) as the vulnerable contracts.…

Other addresses in this report: 0x327bf6dfc38a79393f78866c705193c39b04be01