What happened
PRXVT's Base staking contract was exploited on 1 January 2026 for roughly $97,000, reported as 32.8 ETH. The attacker repeatedly moved transferable staking receipt tokens to freshly deployed CREATE2 helper contracts, allowing each new recipient to claim historical rewards it had not earned.
Transferable staking shares changed hands without updating sender and recipient reward checkpoints. A fresh holder could claim accrued rewards against transferred shares even though it had not earned that accrual.
Case & protocol details
Attack Timeline
The staking receipt token was transferable, but its transfer path did not settle the reward checkpoints. The attacker staked once, moved the receipt tokens to a fresh CREATE2 helper with a default zero reward checkpoint, and had that helper claim rewards calculated from historical rewardPerToken. The tokens were returned and the cycle repeated with a new helper address, draining the shared reward reserve.
CREATE2 made the attack repeatable; the root problem was that reward accounting did not remain correct when receipt-token ownership changed.
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Report x.com
- code Code reference github.com
- analysis Twitter/X Alert x.com
- analysis SlowMist PRXVT incident record hacked.slowmist.io
- analysis PRXVT attacker address basescan.org
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.