Renegade.fi Dark Pool V1 — White Hat Initializer Exploit

Timeline: On May 10, 2026, an anonymous white hat exploited an unprotected initializer in Renegade.fi's V1 dark pool proxy contract on Arbitrum. The vulnerability stemmed from a faulty contract migration during a software update in April 2025, which had left the version counter desynchronized and made the initialize() function callable again. The white hat extracted approximately $209,000 across 27 distinct ERC-20 tokens via delegatecall to malicious logic. Renegade publicly offered a 10% bounty within 45 minutes of detection; the white hat accepted and returned ~$190K (approximately 90%) of the funds. The net loss to the protocol was ~$19K. The exploit was scoped strictly to the V1 Arbitrum deployment, which was paused; other Renegade deployments were confirmed unaffected. The team committed to fully compensating users for the residual loss.