Hack history / 2026 / Hack or exploit
Startale
Hack or exploit on Sep 16, 2026 · Improper Access Control
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$3K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,381
among thefts by dollars lost
What happened
Attacker exploited Startale ERC-7579 smart-account initialization logic to take control of pre-funded counterfactual accounts as they were deployed. The initializeAccount(bytes) permitted an attacker-controlled bootstrap to execute via delegatecall, while an initialization authorization flag stored with transient storage remained set for the entire transaction. The attacker could therefore deploy a victim’s pre-funded account and reinitialize it again in the same transaction with a malicious bootstrap, allowing its assets to be swept
Details
- Date
- Sep 16, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum
Reported by
Related incidents
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "Startale hack, Sep 16, 2026: $3K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht60e76c9ffa/ (data as of 2026-10-31).