Hack history / 2026 / Hack or exploit
TheRedVillage
Hack or exploit on Sep 21, 2026 · ungated PolygonTRVRouter forwardRequest relays an attacker-supplied upgradeTo through the router's _authorizeUpgrade role on the SeasonService UUPS proxy, installing a malicious implementation that uses the proxy's TRVZooKeeper roles to pull every player's approved WETH and sweep the vault
ONE SOURCE · 1 SOURCE
Lost
$81K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,795
among thefts by dollars lost
What happened
No description from DefiLlama or SlowMist; see the sources below.
Details
- Date
- Sep 21, 2026
- Kind
- Hack or exploit
- Method
- ungated PolygonTRVRouter forwardRequest relays an attacker-supplied upgradeTo through the router's _authorizeUpgrade role on the SeasonService UUPS proxy, installing a malicious implementation that uses the proxy's TRVZooKeeper roles to pull every player's approved WETH and sweep the vault
- How in
- Bridge and cross-chain
- Target
- not stated
- Chains
- not stated
Reported by
- DeFiHackLabs exploit reproduction only
Cite this page
SwanBluechip, "TheRedVillage hack, Sep 21, 2026: $81K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht8031a94fd7/ (data as of 2026-11-01).