Renegade Hack

On May 10, 2026, the Renegade V1 deployment on Arbitrum was exploited for approximately $209k. The attack targeted an unprotected initializer on the protocol's Dark Pool proxy. A whitehat attacker has since returned approximately $190k of the stolen funds.

The incident was isolated to the V1 Arbitrum deployment, leaving V1 Base and all V2 deployments unaffected.

The exploit was triggered by a vulnerability in the initialization logic of the Dark Pool proxy contract. Due to a faulty migration in April 2025, the contract's version counter was left out of sync, failing to record that the contract had already been initialized. This allowed an attacker to call the initializer function, which lacked an explicit ownership or status check.

By re-initializing the contract, the attacker injected malicious logic and executed a delegatecall within the proxy’s storage context. This granted the attacker the ability to manipulate the contract's state and drain 27 different ERC-20 tokens. Because the protocol is a dark pool, only about 7% of total volume was affected, as most users do not maintain long-term balances directly within the contract. Renegade has since paused the affected infrastructure and committed to making all impacted users whole.

Victim Contract: 0x30bD8eAb…fDC518

Exploiter Address: 0x777253F2…657777

Exploit Transaction: 0x0e494685…c0c77e