Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
Ethereum FoundationUndisclosed
Hackers took over an Ethereum Foundation email account and sent phishing messages to 35,794 recipients, falsely promoting a staking offer. The Foundation stopped the emails and secured the account; no victims were reported to have lost funds.
50 CentUndisclosed
Rapper 50 Cent said hackers took over his Twitter account and website to promote the GUNIT memecoin.
nftperpUndisclosed
A critical bug was found in nftperp’s clearingHouse contract, and the vulnerable contracts were suspended. The platform later said all funds lost to the bug had been recovered.
TLN ProtocolUndisclosed
TLN Protocol on BNB Chain was attacked through a contract vulnerability. The report cites a loss of about $280,000 in a May 31 attack.
CoinGeckoUndisclosed
A breach at CoinGecko’s third-party email provider exposed some users’ names, email and IP addresses, and email-open location data. CoinGecko accounts and passwords were not affected.
RenzoUndisclosed
Renzo’s official Twitter account was compromised. The team said it was working with Twitter to resolve the issue; the report did not mention stolen funds.
Scroll TokenTokenEthereumUndisclosed
An arithmetic error in Scroll Token’s transfer function let attackers create unlimited tokens from addresses with zero balance. The token’s price then fell 99.99%.
Nicola SebastianiUndisclosed
A member of The Sandbox team had their X account hacked and used to send scam posts and direct messages that appeared to be official.
Rho MarketsUndisclosed
Hackers took over Rho Markets’ official Twitter account and posted suspicious links. The report does not mention stolen funds.
BlockTower CapitalUndisclosed
Fraudsters compromised and partially drained BlockTower Capital’s main hedge fund. The stolen funds had not been recovered, and the hackers had not been caught, according to the report.
Equalizer ExchangeUndisclosed
Equalizer Exchange in the Fantom ecosystem was suspected of being attacked, and the team advised users not to use its website while investigating. The site’s domain was later restored; no stolen funds were reported.
NEAR ProtocolUndisclosed
NEAR Protocol’s official X account appears to have been compromised; its profile was altered and strange posts were published. No stolen funds were reported.
DuneUndisclosed
Dune’s social media account was compromised and used to post a fake airdrop message for about 15 minutes. The team regained control of the account.
BNBXTokenBSCUndisclosed
A precision-loss flaw in the BNBX token’s arithmetic let attackers manipulate its accounting and extract value; the amount taken was not disclosed.
io.netUndisclosed
Attackers exploited exposed links between user and device IDs in io.net’s metadata APIs to make unauthorized updates. GPU access was not compromised, but information shown to users on the frontend was affected.
MerlinUndisclosed
A compromised Merlin Chain Discord management account posted a phishing link.
Velvet CapitalUndisclosed
Velvet Capital users reported abnormal activity on the platform: connecting to its website prompted them to approve wallet access for the protocol. The report did not confirm any funds stolen.
RicoDeFi ProtocolArbitrumUndisclosed
A flaw in Rico’s contract allowed an attacker to make unauthorized external calls and take funds. The amount was not disclosed.
Meson FinanceUndisclosed
A phishing link was posted from Meson Finance’s Twitter account after a third-party API issue; the project said the post was deleted.
JupiterUndisclosed
Jupiter reported that spam bots were flooding its Solana RPC services, disrupting access amid unusually heavy network activity. The team limited the bots; no stolen funds were reported.
Robinson BurkeyUndisclosed
An attacker took over Wormhole co-founder Robinson Burkey’s Twitter account and posted a suspicious link.
Pendle FinanceUndisclosed
Hackers took control of Pendle Finance’s official X account and posted phishing links. The team later regained access.
TrezorUndisclosed
Trezor’s X account was hacked.
TONUndisclosed
The TON Blockchain account on X was compromised, according to an on-chain investigator.
beobleUndisclosed
Beoble’s Twitter account was compromised and used to post phishing links.
BBTDeFi ProtocolEthereumUndisclosed
Attackers exploited a business-logic flaw in BBT’s core smart-contract functions. The specific method and amount lost were not disclosed.
GHTDeFi ProtocolEthereumUndisclosed
GHT’s smart contract was exploited through a business-logic flaw. Public reports did not specify how the exploit worked or how much was lost.
SherlockUndisclosed
An attacker took over security company Sherlock’s Twitter account and used it to post phishing links.
Grayscale CapitalUndisclosed
The hacker group Capital Killer said it attacked Grayscale’s official website, which became inaccessible; the Grayscale Bitcoin ETF page remained available. No stolen funds were reported.
SmoofsDeFi ProtocolPolygonUndisclosed
A reentrancy flaw in Smoofs’ staking contract let attackers manipulate its state during external calls and drain funds.
AleoUndisclosed
A copy-and-paste error in Aleo’s email metadata sent private identification documents, including selfies and government ID photos, to the wrong recipients. The company said ten people were affected.
Tornado CashUndisclosed
A governance attack passed malicious proposals that enabled backdoor code in Tornado Cash’s frontend to hijack deposit certificates.
AvalancheUndisclosed
A bug in Avalanche’s mempool gossip logic caused validators to exchange excessive transaction messages, delaying their checks with other validators and stalling consensus. Block production was interrupted, and an upgrade was issued to disable the faulty logic.
ARPAUndisclosed
ARPA’s official Twitter account was compromised and used to post fake token-claim links.
StarcoinUndisclosed
Starcoin detected abnormal network activity and temporarily suspended its network while investigating.
Keith GrossmanUndisclosed
Keith Grossman’s X account was compromised and used to share links designed to drain users’ wallets.
PhantomUndisclosed
Phantom reported a denial-of-service attack, in which someone tried to overload its systems and disrupt services. User assets were reported secure.
ZeroLendUndisclosed
ZeroLend’s lending market experienced a distributed denial-of-service attack, which overwhelms a service with traffic.
KlaytnUndisclosed
Klaytn’s official Discord server was compromised, and the team warned users not to interact with its posts or links while it worked to regain control.
MasaUndisclosed
Masa’s official Twitter account was suspected of being compromised and used to post fake airdrop links. The report does not describe any stolen funds.
