0xa566592cb94475baf5b46ce373a260dfc9d0df3f

The Red Village exploit (2026-09-21) — attacker addresses

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

The Red Village exploit on EVM, 2026-09-21. DeFiHackLabs summary: TheRedVillage - ungated PolygonTRVRouter forwardRequest relays an attacker-supplied upgradeTo through the router's _authorizeUpgrade role on the SeasonService UUPS proxy, installing a malicious implementation that uses the proxy's TRVZooKeeper roles to pull every player's approved WETH and sweep the vault. Loss as recorded by DeFiHackLabs: 31.426018474517367982 WETH (~$80.7K) swept from TRVZooKeeper on Polygon; 299 players with standing WETH approvals were pulled for 31.350379502001368 WETH and the vault's pre-existing…

The Red Village exploit (2026-09-21) — attacker addresses (Blackpaper BP-1323)

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Reported: 2026-10-15
• Last updated: 2026-10-16

The Red Village incident on 2026-09-21 15:46 UTC (Proxy Upgrade Hijack). The Red Village, an NFT game on Polygon, lost 31.43 WETH pulled from 299 user wallets through their approvals to its vault contract. Source: Blackpaper BP-1323 (https://blackpaper.wiki/incident/BP-1323/), in-house verified record. This report lists only the addresses Blackpaper places under its Attacker addresses section; no victim wallets are included: - 0xa566592cb94475baf5b46ce373a260dfc9d0df3f (Polygon · Attacker: deployed the malicious contract and received the WETH (same address holds the DAI on Ethereum)) -…

Other addresses in this report: 0xe3c4e2ea29cbe47ae205f9c18cbcb0c8c51bfdec, 0xa3822cdf2bb59cefc7e70fa5d693b7e9fbc50afa