Incident date Sep 26, 2026Last updated Oct 8, 2026
3 views
ClosedEthereum L1Access control / reputation hijack (DAOstack UController)Cluster: DAOS-REPHIJACK-2026-09
Estimated loss
$10.9K
Affected users
Number of affected users is not confirmedNot confirmed
Group joining is coming soon.
Investigation
75%
Facts and investigation
Ledger
Attacker
0x5cF6bf4197c13b9C0Ae4AECC6Eb10Ef61bC6bEB0 (Ethereum EOA; its only transaction is the attack)
Funds moved to
4.025 ETH (about $10,861) were sent by the attack factory contract 0xa90bbd7f48279f58a3ca9d8d2fd2c973fed494d7 to the attacker EOA inside the attack transaction. No outgoing transaction and no token transfer from the EOA between Sep 25 and Oct 4, 2026 (Etherscan exports): the funds appear to remain on the EOA (estimated balance about 4.0296 ETH, to be confirmed on the address page).
Linked
Attack transaction 0xcfff7b060a7fb881f4bd8d2498dbe4e09454f7afaf5328fc12b59812f6737cc1 (block 26059090). Victim avatar (Genesis Alpha treasury) 0x7b11dFb29504abc8C0DFa60DC7E0Aa2AAe836DB0; Reputation contract 0x6256294145fb529db7b248eb86b4e6ef30f55bf9. Five contracts created in the attack transaction: 0xa90bbd7f48279f58a3ca9d8d2fd2c973fed494d7, 0x304a8e57b7a84ab1c66bc6216f0634c23eeb3f18, 0xd9902ea5a84a236a86a66d37b81dd1fe10c3f181, 0x7f7d02dd71f9064c6c0f095d516610e89c31d0b7, 0x20aef0795905676238062b60aa2bc43099346b62. Gas funding: 0.0049875 ETH from RAILGUN: Relay Adapt (0xac9f360ae85469b27aeddeafc579ef2d052ad405) on Sep 26 at 03:33:35 UTC (tx 0xad372661403c7104c10817105e8112d655bcd01a9f4b72a0d6cfb1c4780fa840, sent by relayer 0x624e23479010660c3d7b0e318ce510d0ad86b285). The same Railgun-funding pattern (0.005, 0.05 or 0.1 ETH minus the 0.25% fee) appears in the FlashLoopAdapter and MUSystem incidents; it is a behavioural similarity, not evidence of a common operator.
Chronology
1 beat
On Sep 26, 2026 at 03:33:35 UTC a fresh Ethereum wallet received 0.0049875 ETH from the Railgun privacy protocol, 24 minutes 48 seconds before the attack. At 03:58:23 UTC (block 26059090) it sent a single contract-creation transaction whose constructor ran the whole exploit. A factory contract deployed a shape-shifting fake Avatar and called UController.newOrganization(), registering itself as a full-permission scheme over Genesis Alpha's real Reputation contract. It then minted 20,000 REP to itself (supply 9,738.6 to 29,738.6), proposed and self-voted a scheme on the real Avatar (about 67% after a 200 REP vote-cost burn), and called sendEther to take the whole 4.025 ETH treasury (about $10,861). The bug class is the one documented in the February 2019 Genesis Alpha incident; this 2026 transaction re-exploits it on the same DAO. DeFiHackLabs reconstructed it on Sep 26-27 (mainnet fork at block 26059089). No project statement and no second independent source were found; the evidence is the Etherscan transaction plus the merged PoC. As of Oct 4, 2026 the attacker EOA has made no further transaction.
