Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Data last changed · Checked daily
2,405 incidents
Rujira AMM StrategiesDeFi ProtocolTHORChain$200K
An attacker exploited faulty skew calculations in Rujira’s concentrated-liquidity strategy to manipulate BTC/USDC trading and unbalance liquidity positions. The losses affected Liquidy Finance and other users; Rujira halted the application and planned reimbursements.
ArcusDeFi ProtocolRobinhood Chain$2.23M returned$2.23M
An accounting flaw in Arcus Perps let an attacker inflate a recorded balance through transfers between subaccounts, then withdraw USDG. A bridge rate limit blocked additional withdrawal requests, and Arcus covered the shortfall from its treasury without affecting other users’ balances.
InitiaChainInitia$615K
Using compromised rollup infrastructure keys, an attacker forged IBC transfers—cross-chain asset messages—to withdraw funds from Initia escrow accounts. Some assets left through Noble, while most remaining assets stayed on the halted network; recovery was still under investigation.
Across ProtocolDeFi ProtocolBridgePlasmaUndisclosed
A social-engineering attack on Across Protocol’s domain registrar let an attacker redirect the site to a phishing page that tricked some users into wallet interactions and unauthorized withdrawals. The stolen amount was undisclosed, and Across pledged to compensate affected users.
Ankr Ethereum Cross-chain BridgeDeFi ProtocolBridgeEthereum$305K
An attacker submitted forged bridge receipts for a previously redeemed Optimism deposit, changing the recipients, tokens, and amounts while using valid signatures from the bridge’s trusted signer. The bridge accepted them and released staking tokens and other assets.
SwarmUndisclosed
Attackers published a malicious Bee JavaScript package and a trojanized Swarm Desktop update. The malware targeted node settings and wallet keystores, sent the data to attackers, and installed a remote-access backdoor; no fund losses were confirmed.
ACryptoSDeFi ProtocolArbitrumBSCPolygon+2 chains$665K
A missing input check in ACryptoS vault deposits let attackers submit incomplete token amounts, causing vaults to issue too many shares for small deposits. They used the shares to withdraw assets from 77 vaults across five chains.
LNbitsWalletBitcoinLightning Network$1.7K
Attackers exploited vulnerabilities in LNbits installations to create unauthorized accounts and withdraw funds. The precise method and total losses were not yet known; LNbits told operators to shut down servers and later released a security update.
Keplr WalletWallet$6.01M
A vulnerability in Web3Auth’s infrastructure exposed private keys for some Keplr wallets created through Google or Apple login, enabling unauthorized transactions. Keplr and Web3Auth moved funds from exposed wallets to recovery addresses; the amount stolen before those moves was undisclosed.
Degen Coin Flip$10K
Attackers exploited a flaw in Degen Coin Flip’s Degen Spin game, with losses coming from the project’s house funds. Player funds were safe; the project paused Spin and side bets while fixing the issue.
$TENDRILDeFi ProtocolBSC$550K
A flaw in TENDRIL’s sell logic let the token pair’s reserves update before the full sale arrived, creating an imbalance that an attacker exploited to drain USDT liquidity from the PancakeSwap pool.
FLOKI Trading BotUndisclosed
The FLOKI team reported an exploit in its Telegram trading bot and took the bot offline. The attack’s method and losses were not disclosed; the team said it was identifying affected users and securing remaining funds.
LoopscaleDeFi ProtocolSolanaUndisclosed
Loopscale reported a campaign of malicious API requests that exploited misconfigured asset-pricing settings to obtain undercollateralized loans and attempt outsized redemptions from its SOL and USDC vaults. The protocol said affected vaults were made whole and user deposits suffered no losses.
InsurancePool/CoreVault$112K
An attacker used a flash loan—a loan borrowed and repaid within one transaction—to manipulate prices used by CoreVault. This inflated a redemption and let the attacker extract excess funds from InsurancePool.
Mercado BitcoinCEXBitcoinEthereumSolana+7 chains$40M
Attackers compromised a Mercado Bitcoin system and moved cryptocurrency from exchange-associated wallets across multiple blockchains. Tether froze some USDT linked to the theft; the exchange said customers would not bear losses and no customer data was exposed.
Solana MEV Bot King$856K
An attacker emptied the Solana MEV bot King’s main wallet using transfers signed with its private key. Some stolen funds were frozen after being bridged to Ethereum; the rest remained in an Ethereum address.
BitMartCEXBaseArbitrumOptimism$391K
Attackers breached BitMart and took cryptocurrency from exchange-associated wallets on Base, Arbitrum, and Optimism. The entry method was unknown, and investigators said some funds were linked to the Mercado Bitcoin exploit that day.
Crédit Mutuel Arkéa$133M
An attacker accessed a third-party service provider’s platform and used Crédit Mutuel Arkéa’s accounts to transfer funds to other financial institutions; some may later have been converted to cryptocurrency. The bank said customer assets were unaffected, while the final loss remained under assessment.
BTCPay ServerWalletBitcoinLitecoin$1.63M
A vulnerability in older self-hosted BTCPay Server installations let attackers compromise servers and sweep Bitcoin and Litecoin from hot wallets, whose spending keys were stored on the servers. Wallets using keys held off-server, including hardware wallets, were unaffected.
Sovryn DexDeFi ProtocolRootstock$539K
An attacker exploited a failure to verify actual receipts during fee processing in Sovryn’s XUSD/WRBTC pool, receiving XUSD that was partly converted to BTC and ETH. Sovryn applied emergency fee controls, delisted the pool, and began assessing liquidity-provider losses.
Premia V3DeFi ProtocolArbitrum$437K
An attacker created empty option pools and used flash loans to buy options that locked collateral in Premia V3 vaults, then withdrew that collateral as liquidity. Six underwriter vaults on Arbitrum were affected.
b14gDeFi ProtocolCORE$1.47M
Attackers withdrew about 97 million CORE tokens staked through b14g and sent them to addresses they controlled. Some CORE remained on the Core network and some was frozen by exchanges; staked Bitcoin was unaffected.
Sovryn LendDeFi ProtocolRootstock$914K
Attackers exploited Sovryn’s lending and margin contracts on Rootstock, taking XUSD and WRBTC. A 24-hour withdrawal delay helped the team block additional XUSD withdrawals before those funds reached the attackers.
TrovesDeFi Protocol$667K
A replaced rebalancing contract retained permission to act on Troves’ xWBTC/WBTC vault, allowing an attacker to take about 8.6 WBTC. Troves revoked the contract’s permissions and paused three vaults as a precaution.
12 DeFi frontends (including Flap, Kintsu, etc.)$138K
Attackers hijacked the domain settings of at least 12 DeFi websites and redirected visitors to malicious versions that used a wallet-draining tool. Users who connected wallets and signed transactions lost assets; the underlying smart contracts were not compromised.
VergeX$3.69K
Attackers targeted the VergeX trading platform, triggering withdrawal verification emails for some users. Risk controls stopped the incident quickly, the affected USDC was returned, and other users’ funds were unaffected.
BinanceCEXEthereumBitcoinTRON+4 chains$6.36B
Attackers gained access to Binance’s internal systems and signing privileges, then made unauthorized withdrawals across multiple blockchains. Some stolen assets were frozen or intercepted, and Binance said it would cover the losses.
Our coverage: Binance’s Fake Job Interview Used One Trust-building TrickSourceRekt report
Polymarket InternationalPrediction MarketPolygon$2.7M
Malicious code delivered through a compromised third-party monitoring service hijacked Polymarket trading sessions, selling users’ market positions and transferring assets to attacker-controlled wallets. Polymarket paused trading and promised to reimburse affected users.
TranchePool$1.01M
A settlement flaw in a TranchePool on Avalanche treated a scheduled principal payment as received at the start of a new UTC day. This wrongly restored the attacker’s borrowing capacity, letting them draw the same USDC a second time.
Hifi FinanceDeFi ProtocolEthereum$1M
An attacker used last-minute votes to pass a malicious Hifi Finance governance proposal to change the protocol’s contract, transfer collateral, and mint 25 million HIFI tokens. Reports differed on whether the proposal had been executed at the time.
zkLink NovaDeFi ProtocolBridgeEthereum$783K
A flaw in zkLink’s bridge let an attacker reuse an already authenticated message to install a false record of Layer 2 transactions. They then used forged withdrawal proofs to take ETH and other tokens from the Ethereum bridge.
Fence FinanceDeFi ProtocolAvalanche$1.01M
An attacker used a flash loan to obtain an inflated share of a Fence Finance tranche vault, then redeemed those shares to withdraw about $1.01 million in USDC.
Predict.funPrediction MarketBSC$400K
A suspected compromise of Predict.fun’s third-party API documentation site was linked to unauthorized transfers from users’ smart wallets. The project took the site offline and pledged to reimburse affected users.
Diamante ($DIAM)Undisclosed
Using stolen company access keys, an attacker took control of Diamante’s token contract on BNB Chain and minted 161 million unauthorized DIAM tokens. Exchanges froze some of the tokens, and the team secured the contract with a new MPC wallet.
Zilliqa X-BridgeDeFi ProtocolBridgeZilliqaUndisclosed
A security incident affected Zilliqa’s X-Bridge and ZRC2 proxy contracts linked to some liquidity pools, affecting tokens including zUSDT, SEED, kUSD, and Zoge. Native ZIL and the Zilliqa EVM network were reported unaffected.
Unnamed Safe Multisig (Avalanche Trading Inventory)$7.45M
A misconfigured Avalanche multisig had granted unlimited token approvals to an address where anyone could deploy code. An MEV bot front-ran an attacker’s attempt and took about $7.45 million in assets; the bot said it would negotiate their return.
Bloom TradingWalletSolana$953K
A remote code execution flaw in a third-party module used by Bloom Trading’s infrastructure enabled unauthorized transfers from users’ Solana wallets, draining about 9,408 SOL. Bloom said it would reimburse affected users and paused some services while investigating.
ChainstackUndisclosed
An attacker entered Chainstack’s development environment through a Grafana instance with default credentials, then reached parts of production systems. They accessed a customer account database and systems holding node credentials, but customer-facing services remained unaffected.
Myriad MarketsDeFi ProtocolBSCUndisclosed
An attacker used a private key exposed through a flaw in a third-party library to access Myriad’s market-management wallet and manipulate 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permissions and said affected markets would be voided and users refunded.
YapeswapDeFi ProtocolEthereum$21.9K
Yapeswap’s governance contract allowed a proposal to pass without a minimum number of votes, letting an attacker take control of a factory setting and install a malicious registry. It redirected deposits to fake vaults, causing about $21,900 in losses.
