Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
Ben ArmstrongUndisclosed
Hackers took over Ben Armstrong’s Twitter account and used it to promote a scam aimed at stealing users’ NFT assets.
FranklinUndisclosed
Franklin said his Twitter account had been taken over and warned that posts from the morning of June 9 were not his. The report did not mention stolen funds.
ArbitrumUndisclosed
A bug in Arbitrum’s sequencer temporarily stopped batches of transactions from being submitted to the main chain, preventing those transactions from being confirmed there. The bug was fixed and batch submissions resumed.
XverseUndisclosed
A bug left Xverse wallet helper words unencrypted on users’ devices. Xverse fixed it and said the issue did not affect its iOS or Android apps; no funds were reported stolen.
ColeUndisclosed
The Twitter account of Cole, co-founder of Pudgy Penguins, appeared to be compromised, with reports linking the incident to the PinkDrainer group.
CosmWasmUndisclosed
A stack overflow bug in CosmWasm could stop new smart contracts from functioning on Cosmos-based blockchains. The report describes a vulnerability, not a theft or confirmed disruption.
TRONUndisclosed
A vulnerability in TRON’s multisignature accounts could have put assets at risk, depending on the account’s signer settings. The flaw was disclosed and fixed before any user assets were reported at risk.
AleoUndisclosed
A contributor found an inflation flaw in the Aleo network and used it to halt block production, then contacted the team. Aleo fixed the bug.
Polygon zkEVMUndisclosed
Flaws in Polygon zkEVM’s deposit-claim processing could let attackers overload network operators or block legitimate claims, making the network unusable for new users. The team fixed the bugs; no funds were at risk.
Arthur MadridUndisclosed
Hackers took over The Sandbox CEO Arthur Madrid’s Twitter account and posted a phishing link advertising a fake SAND token airdrop.
MultichainUndisclosed
Some Multichain cross-chain routes became unavailable, and users reported delays in receiving funds from transfers. Multichain said pending transactions would be credited when service resumed and promised compensation; the report did not describe a theft.
TrezorUndisclosed
Unciphered demonstrated that physical access and specialized equipment could exploit a Trezor Model T vulnerability to extract its recovery phrase, which can restore access to a wallet. Trezor said a strong passphrase can prevent the attack from working.
Celer NetworkUndisclosed
A flaw in Celer Network’s State Guardian Network could have let a malicious validator submit many fake votes and change network state. Celer patched it before it was publicly accessible; no funds were lost.
AaveUndisclosed
A contract incompatibility on Polygon left about $110 million in Aave V2 assets temporarily unable to be withdrawn, borrowed, or repaid. Funds were not at risk, and a fix was submitted for a vote.
StacksUndisclosed
A report highlighted recurring problems on Stacks, including issues with its STX stacking mechanism and more frequent block reorganizations, in which the chain’s recent transaction history is changed.
MirrorUndisclosed
Mirror’s publishing app was unavailable because it was experiencing heavy load. No funds were reported stolen.
EOS EVMUndisclosed
EOS EVM released an update to fix a serious security vulnerability. The upgrade was required for EOS EVM contracts, network nodes and RPC components; no stolen funds were reported.
OpenSeaUndisclosed
A reported OpenSea royalty-setting issue appeared to prevent NFT projects from setting or changing royalties after a change to how ownership was identified. No theft or financial loss was reported.
WEEBUndisclosed
An attacker used WEEB’s performUpkeep function to burn tokens held in a trading pair, pushing up WEEB’s price and making a profit of 16 ETH.
REI NetworkUndisclosed
REI Network’s official Twitter account was hacked and posted airdrop-related information. The network warned users not to trust the airdrop claims.
Daniel AlegreUndisclosed
Hackers took control of Yuga Labs CEO Daniel Alegre’s Twitter account. Yuga Labs warned users about minting links and accounts impersonating him; no stolen funds were reported.
UniSat MarketplaceUndisclosed
A code flaw in the newly launched UniSat Marketplace enabled double-spend attacks, in which the same funds could be spent more than once. Of 383 transactions, 70 were identified as affected, and UniSat said it would investigate and compensate users for losses.
zkLinkUndisclosed
zkLink’s Discord server was compromised, and attackers posted phishing links. The incident report does not mention any funds being stolen.
KyberSwapUndisclosed
KyberSwap found a potential vulnerability in KyberSwap Elastic and urged liquidity providers to withdraw their funds. No user assets had been lost at the time.
zkSyncUndisclosed
zkSync stopped producing blocks after a failure in its block-queue database. Its API remained available, and transactions continued entering the queue, but block generation was halted.
Degen ZooUndisclosed
Degen Zoo suspended its game and began investigating a suspected hack involving Binance Oracle. The team had not identified a vulnerability or confirmed how funds were affected.
FASTSWAPUndisclosed
FASTSWAP on BNB Chain was attacked using a flash loan, and lost 26.77 BNB.
Archive of PEACEMINUSONEUndisclosed
The Archive of PEACEMINUSONE NFT series was reported to contain a previously known software vulnerability that might be exploitable. No attack or loss was confirmed.
Circle's Chief Strategy OfficerUndisclosed
A scammer took over the Twitter account of Circle’s chief strategy officer and used it to promote a fake USDC rewards offer. The tweet was deleted, and Circle said it was investigating.
Sense FinanceUndisclosed
Sense Finance was indirectly affected by the Euler Finance attack. No specific loss or impact on Sense Finance was reported.
OpynUndisclosed
Opyn’s Zen Bull strategy was exposed to losses from the Euler Finance attack because it may have used Euler for loans backed by collateral. Opyn had not disclosed the loss amount or its response.
iTokenUndisclosed
Former employees reportedly installed a backdoor in cryptocurrency wallet software to obtain users’ recovery phrases and private keys. More than 27,000 recovery phrases and 10,000 private keys were obtained, and users’ wallet credentials were leaked.
The SandboxUndisclosed
An attacker accessed a Sandbox employee’s computer and used the account to send a fake email containing links to malware that could take control of recipients’ computers and access personal information. The employee’s access was disabled, and no further impact was identified.
SolanaUndisclosed
A fork in the Solana network sharply reduced its transaction capacity, preventing users from carrying out on-chain transactions and transfers.
NamecheapUndisclosed
Hackers compromised Namecheap’s email account and used it to send phishing emails posing as MetaMask and DHL. A fake MetaMask page sought users’ seed phrases or private keys to steal wallet assets.
OneKeyUndisclosed
A security researcher demonstrated that a weakness in the OneKey Mini hardware wallet could expose its recovery phrase, which can restore access to a wallet. OneKey said it patched the flaw and that no users were affected.
AzukiUndisclosed
Azuki’s Twitter account was compromised and used to post fake virtual-land claim links. The team regained control; the report does not mention any funds being taken.
NFT GodUndisclosed
Malware downloaded through a sponsored link gave attackers access to NFT God’s computer, where a wallet recovery phrase had been used online. They stole crypto assets and NFTs and posted fraudulent links through compromised accounts.
Google ChromeUndisclosed
A Chrome and Chromium browser flaw could let attackers follow a symbolic link—a file-system shortcut—to steal sensitive files, including encrypted wallet files. The report says phishing sites could be used to target victims but does not describe a specific theft.
ChimpersUndisclosed
Chimpers’ official Twitter account was hacked and used to post links to fake websites that lured users into attempting fraudulent NFT mints.
