How Leaked Listing Signatures Let One Wallet Sweep 201 Doginal Dogs
October 26, 2026, DogeFeed Press
A flaw in how market.doginaldogs.com handled listing signatures let one wallet sweep 201 Doginal Dogs from 194 wallets in six transactions around 7:09 AM ET on Oct 26, 2026. Every one of those transfers went through 0x82 listing signatures. This was not a seed-phrase hack. No private keys were exposed.
What happened
Collectors and public posts on X traced the sweep to how market.doginaldogs.com signed listings. One affected listing was Doginal Dog #6398 (Wizard), which was taken without the seller being paid.
- Listings were signed with SIGHASH_NONE|ANYONECANPAY (0x82). That flag does not commit to a price or to any outputs.
- The marketplace then served those signatures to every visitor.
- With a valid signature that didn't specify where the coins should go, anyone holding it could redirect the inscription without paying the seller.
The on-chain trail can be checked on the Sochain explorer (sochain.com/doge).
Receiving address (per @DogeFeedApp): D6ZJAGkdFJn9cb3y2QAVwv5QtMXfVHihZ4
Tracking
DogeFeed is tracking all 201 Dogs, including #6398, at https://radar.dogefeed.app/stolen. The tracker refreshes about every 3 minutes. When DogeFeed posted its update (https://x.com/DogeFeedApp/status/2114958130664882686), the Dogs and DOGE in that address had not moved. DogeFeed asked marketplaces and exchanges to flag the address.
Community and news posts on X say Doginal Dogs leaders replaced stolen pieces out of their personal collections. DogeFeed has not independently verified the amounts.
Why 0x83 listings are different
DogeFeed listings use SIGHASH_SINGLE|ANYONECANPAY (0x83). This flag commits the seller's payment output, so the price and payout are locked into the signature. DogeFeed never publishes seller signatures. Only the buyer's signature is added at checkout. DogeFeed's audit is public: https://x.com/DogeFeedApp/status/2114940019945169219
What to do now
- Don't relist on any market without knowing which sighash flag it uses.
- Look up your Dog on https://radar.dogefeed.app/stolen.
- In the meantime, you can use dogefeed.app, doggy.market, and Nintondo.io for trading. You can also trade Doge NFTs on the Dogecoin social network at https://dogefeed.app.
This article is limited to facts that have been publicly reported. It does not name or accuse any individual.