0x901dafde7057bc2478d1ef640fb5515ea4757aab

Startale exploit (2026-09-16) — attacker addresses

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

Startale exploit on EVM, 2026-09-16. DeFiHackLabs summary: Startale - transient storage init flag outlives the constructor and lets anyone reinitialize an ERC7579 account and drain it. Loss as recorded by DeFiHackLabs: 427.551160 USDC drained in this batch tx (32.555561 USDC reproduced across 3 of 23 victim accounts; ~$2,876 USDC+USDT aggregate across 41 known batches). Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): -…

Startale exploit (2026-09-16) — attacker addresses (Blackpaper BP-1278)

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

Startale incident on 2026-09-16 (Improper Access Control). Startale's ERC-7579 counterfactual smart accounts on Ethereum were drained through an initialization permission that stayed valid too long. Source: Blackpaper BP-1278 (https://blackpaper.wiki/incident/BP-1278/), in-house verified. This report lists only the addresses Blackpaper places under its Attacker addresses section; no victim wallets are included: - 0x901dafde7057bc2478d1ef640fb5515ea4757aab (Ethereum · First campaign EOA; sent the representative exploit transaction) - 0x91138476a3fde4bf69c253c134b1647377348b5b (Ethereum ·…

Other addresses in this report: 0x91138476a3fde4bf69c253c134b1647377348b5b