Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Drift ProtocolDeFi ProtocolSolana$295M
Attackers tricked Drift Protocol security council members into pre-signing transactions that gave them administrative control. They listed a worthless fake token as collateral, deposited it, and withdrew about $285 million in real assets.
Galaxy Digital$10K
Unauthorized access was limited to Galaxy Digital’s isolated development and testing environment; production systems, trading platforms, and customer accounts were unaffected. The incident involved less than $10,000 in company testing funds.
LML/USDT staking protocolDeFi ProtocolBSC$950K
The attacker used flash loans to distort LML’s market price and exploit a staking contract that calculated rewards using an outdated price, claiming oversized LML rewards and selling them. The attack netted about $950,000 and caused LML’s price to fall 99.6%.
WhaleBitDeFi ProtocolPolygon$10.5K
An attacker used a flash loan to sell CES tokens and depress their pool price, then exploited the staking system’s price-dependent redemption calculations. This inflated staking payouts by about 14.4% to 15.7%.
axios npm packageUndisclosed
A malicious dependency introduced harmful code into version 1.14.1 of the axios npm package, creating a software supply-chain attack. The report did not state that funds were stolen.
Arf's official X accountUndisclosed
Arf’s official X account was reported compromised. Huma Finance warned people not to interact with its posts until the account was secured.
Steakhouse FinancialUndisclosed
A phone-based social engineering attack against Steakhouse Financial’s cloud provider led to changes to the DNS records for its website and app, redirecting them to a malicious address. The changes were reversed; vaults, smart contracts and depositor funds were unaffected.
GoonFiDeFi ProtocolSolana$254K
A configuration and pricing-logic bug mispriced GoonFi v2’s WSOL/USDC pool on Solana, allowing searchers to drain about $254,000 in a single transaction. The project halted the program.
VTSwapHookDeFi ProtocolArbitrumUndisclosed
A pricing error in VTSwapHook used midpoint estimates instead of correctly integrating the trading curve, while fee-accounting bugs inflated virtual reserves. The incident report does not specify how much was taken.
Unknown Stake Contract$133K
An attacker manipulated the TUR-NOBEL pool price, then staked TUR to trigger rewards calculated using the inflated price. They claimed the rewards through a referral account and swapped the TUR for USDT, taking about $133,000.
TUR StakingDeFi ProtocolBSC$133K
An attacker manipulated the TUR-NOBEL pool price to inflate TUR’s spot price, which the staking contract used to calculate oversized rewards. The attacker claimed the rewards and swapped the TUR for about $133,000 in USDT.
LiteLLMUndisclosed
A supply-chain attack on the LiteLLM package distributed through PyPI could steal sensitive data from systems where the package was installed, including credentials, API keys, and crypto-wallet data. The report did not specify stolen funds.
MoonwellUndisclosed
An attacker bought enough MFAM tokens to pass an initial Moonwell governance vote that could transfer control of lending markets and other components to a malicious contract. No funds were reported taken, and voting was ongoing, with opposition votes then leading.
UdonFi LendingDeFi ProtocolChromiaUndisclosed
A flaw in UdonFi Lending’s withdrawal function let an attacker take funds without proper authorization. The team said the assets remained on Chromia and offered a bounty for returning most of them; the total loss was not disclosed.
Bitcoin Depot$3.67M
Attackers infiltrated Bitcoin Depot’s IT systems and obtained credentials for its digital-asset settlement accounts, enabling unauthorized transfers of about 50.9 BTC. The company said customer accounts and data were unaffected.
BCE-USDT liquidity pool$679K
A flaw in BCE’s token burn mechanism let attackers bypass trading restrictions and manipulate the BCE-USDT pool’s reserves, extracting funds from the PancakeSwap pool.
BCEDeFi ProtocolBSC$679K
A flaw in BCE token’s burn mechanism let malicious contracts trigger burns inside a PancakeSwap pool and distort its BCE-USDT reserves. The attacker used the imbalance to extract value from the pool.
Cyrus FinanceDeFi ProtocolBSC$5M
The attacker used a flash loan to manipulate a PancakeSwap pool’s spot price, exploiting Cyrus Finance’s withdrawal logic to take excess liquidity from a position. They made about $516,840, which was later laundered through Tornado Cash.
ResolvDeFi ProtocolEthereum$24.5M
A compromised private key used by Resolv’s service allowed the attacker to mint about 80 million USR stablecoins without adequate backing, then swap them for ETH. The attacker extracted roughly $25 million before the protocol paused its contracts.
NeutrlDeFi ProtocolEthereumUndisclosed
Attackers socially engineered Neutrl’s domain provider and redirected the official website to a malicious interface that prompted users to approve token transfers. Reports said no funds were stolen.
dTRINITY dLENDDeFi ProtocolEthereum$257K
An attacker exploited an almost-empty dLEND lending market on Ethereum, using repeated flash-loan fees to inflate collateral values and borrow the pool’s dUSD supply. This created about $257,000 in bad debt; the team said it would cover the losses.
CheckoutPoolDeFi ProtocolPolygon$85.7K
CheckoutPool’s unprotected bridge function on Polygon let attackers redirect settlement to accounts they controlled and drain funds.
Venus ProtocolDeFi ProtocolBSC$3.7M
An attacker directly transferred THE tokens into Venus Protocol’s BSC market to inflate its exchange rate, then used the inflated value to borrow assets. The attack extracted about $3.7 million and left the protocol with bad debt.
Goose FinanceDeFi ProtocolBSC$8.44K
A flaw in Goose Finance’s vault share accounting let the attacker repeatedly deposit and withdraw before rewards were settled, creating shares worth more than they should have been. The attacker redeemed them after the harvest and profited.
Aave V3DeFi ProtocolEthereum$862K returned$862K
A misconfigured price oracle undervalued wstETH on Aave V3, triggering wrongful liquidations of 34 healthy positions and about $862,000 in losses. The Aave DAO fully compensated affected users; no protocol funds were stolen.
Stake DAODeFi ProtocolArbitrumBase$176K
A flaw in Stake DAO’s oracle updater let an attacker inject false cross-chain block data and forge vote proofs, draining about $176,000 in campaign rewards. The incident was later treated as a white-hat event, and most funds were recovered.
AMDeFi ProtocolBSC$132K
AM’s deferred-burn mechanism could accumulate an unbounded token burn that was applied on a later sale. Attackers used flash loans to inflate the pool’s USDT reserves before triggering the burn and selling at an artificially favorable price.
AM/USDT pool$131K
A flaw in the AM token’s burn mechanism let an attacker reduce the AM/USDT pool’s reserves without updating its recorded balances, artificially inflating AM’s price. The attacker sold AM back to the pool for about $131,000.
DBXenDeFi ProtocolEthereum$150K
A sender-identity mismatch in DBXen’s meta-transaction system let attackers claim fees accumulated across earlier burn cycles. They used new addresses to claim the fees, causing losses of about $150,000.
BONKfunICOSolana$30K
Attackers socially engineered the domain registrar to take control of BONKfun’s website and replace it with a fake page that prompted users to sign malicious transactions. The attack caused about $30,000 in customer losses.
MT-WBNB liquidity pool$242K
A flaw in the MT-WBNB pool’s trading restrictions let an attacker use the router to acquire MT tokens, then burn tokens directly from the pool to inflate its price. The attacker sold the tokens for WBNB and made an estimated $242,000.
Movie TokenDeFi ProtocolBSC$242K
Movie Token’s contract burned tokens directly from the PancakeSwap liquidity pool without updating the pool’s records. Combined with a flash swap, this sharply reduced the pool’s MT reserves and enabled the attacker to sell tokens at inflated prices.
Gondi V3NFTfiEthereum$230K
An access-control flaw let attackers call Gondi V3’s purchase function without the required ownership check, using lingering token approvals to take about 78 NFTs worth roughly $230,000. The vulnerable contract was disabled.
Molt EVMOtherBase$127K
A missing access check let an attacker replace Molt EVM’s authorized token spawner with their own contract, then mint mEVM tokens for free and sell them for WETH.
Solv ProtocolDeFi ProtocolEthereum$2.7M
A callback during BRO vault deposits minted tokens before the transaction finished, allowing the same deposit to be counted repeatedly and inflating 135 BRO into 567 million. The attacker took about 38 SolvBTC, worth roughly $2.7 million; Solv said it would cover affected users’ losses.
FOOMCASHDeFi ProtocolEthereumBase$2.26M
A misconfigured verifier on FOOMCASH let attackers submit forged zero-knowledge proofs—cryptographic claims that could not be properly checked—and withdraw about $2.26 million in FOOM tokens. A white-hat recovered about $1.84 million.
Inverse Finance$240K
An attacker manipulated DOLA’s price on Ethereum, triggering liquidations of multiple Inverse Finance users’ positions. The incident caused an estimated $240,000 loss.
Curve LlamaLendDeFi ProtocolEthereum$240K
The attacker used a flash loan and a donation to inflate the sDOLA vault’s exchange rate, which the market’s oracle treated as a spot price, triggering liquidations of 27 borrowers. The attacker gained about $240,000; borrowers lost about $822,000 in equity.
BitrefillUndisclosed
A compromised employee laptop let an attacker access parts of Bitrefill’s databases and cryptocurrency wallets, exposing purchase records and limited customer information. The report did not specify stolen funds.
Wise Lending V2DeFi ProtocolArbitrumEthereum$66K
A flash-loan attack exploited logic flaws in Wise Lending V2’s Ethereum and Arbitrum deployments, draining about $66,000 from its pools.
