Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
X7 Finance$16.5K
An accounting bug in X7Pioneer’s reward-claim function repeatedly counted the same ETH as rewards when no rewards were claimable. The attacker exploited this by adding ETH to the contract and drained about 6.78 ETH.
Internet TokenTokenBase$16.4K
An attacker supplied a fake Uniswap V3 pool to exploit Internet Token’s LiquidityUnifier contract, triggering unauthorized INT minting through a callback. They sold newly minted tokens into the genuine pool for about 5.85 WETH.
ElevateFiDeFi ProtocolPolygon$16K
The attacker used flash-loan-funded buying to inflate EFI’s price in a Uniswap pool, which ElevateFi’s staking vault read directly without a price safeguard. This let the attacker create staking positions recording $2.5 million in principal using only 713.5 EFI each time, repeated 100 times.
BitBay StableVaultDeFi ProtocolPolygon$14.8K
The attacker used reposition() to reduce BitBay’s vault liquidity to zero, then redeemed a tiny share. A withdrawal flaw sent the vault’s entire token balance instead of the user’s proportional share, draining about 14,838 DAI.
GebProxyActions$14K
GebProxyActions’ quitSystem function lacked caller checks, allowing an attacker to bypass the safe manager’s permission check and transfer collateral from safes whose owners had previously called the function directly.
Fractal ProtocolDeFi ProtocolArbitrum$13.7K
The attacker used flash-loan callbacks to repeatedly re-enter Fractal’s USDF vault, exploiting its share calculations to withdraw more USDC.e than they deposited. About 13,700 USDC.e was taken, leaving the vault’s liquid USDC buffer nearly empty.
MALT$13.4K
A flaw in MALT’s swap logic let an attacker trigger a rebalance that moved treasury DAI into the pool and treated it as their own contribution. They withdrew a disproportionate amount of MALT, causing about $72,000 in losses.
Vara BridgeDeFi ProtocolBridgeEthereum$12.8K
An attacker reportedly bypassed Vara Bridge’s cross-chain proof checks by submitting fraudulent Merkle roots, records used to verify messages. This allowed unauthorized messages to be processed on Ethereum and caused about $12,776 in losses.
Lixir FinanceDeFi ProtocolEthereum$12.3K
A flaw in Lixir Finance’s permit signature checks let an attacker reuse one signature to gain approval to withdraw assets from vault holders across multiple vaults. The attacker took WETH, USDC, USDT and LIX worth about $12,300.
SAS Token$12K
A flaw in SAS Token’s custom transfer logic let an attacker build up sell-burn credit, then burn tokens directly from the liquidity pool and alter its reserves. The attacker swapped tokens to extract a profit.
TGAI$11.9K
The attacker used a flash loan and helper contracts to manipulate reserves in a TGAI liquidity pool on PancakeSwap, then swapped tokens to take a profit. The project lost about $11,940.
MureDeFi ProtocolEthereum$11.7K
A flaw in signature checking let an attacker use a malicious contract to bypass verification and drain 4.85 million QUEST tokens that had been approved for Mure’s distribution contract. The tokens were swapped for about 5.45 ETH.
GPU.NETDeFi ProtocolEthereum$10.6K
An unverified report claimed a roughly $10,600 incident involving GPU.NET on Ethereum. No supporting news coverage, security report, or on-chain confirmation was reported.
WhaleBitDeFi ProtocolPolygon$10.5K
An attacker used a flash loan to sell CES tokens and depress their pool price, then exploited the staking system’s price-dependent redemption calculations. This inflated staking payouts by about 14.4% to 15.7%.
Degen Coin Flip$10K
Attackers exploited a flaw in Degen Coin Flip’s Degen Spin game, with losses coming from the project’s house funds. Player funds were safe; the project paused Spin and side bets while fixing the issue.
Galaxy Digital$10K
Unauthorized access was limited to Galaxy Digital’s isolated development and testing environment; production systems, trading platforms, and customer accounts were unaffected. The incident involved less than $10,000 in company testing funds.
Set ProtocolDeFi ProtocolEthereum$9.6K
A malicious pre-issuance hook exploited unlocked accounting in Index Coop’s ExchangeIssuance contract, changing position values during issuance and causing Set Protocol to transfer excess assets.
LootBot AI$9.6K
LootBot AI’s xLoot staking contract counted duplicate NFT IDs repeatedly when calculating redemption rewards. An attacker exploited this with repeated IDs to drain about 6.21 ETH, keeping roughly 4.1 ETH after repaying a flash loan.
Chi ProtocolDeFi ProtocolEthereum$8.5K
The attacker flash-borrowed WETH to buy depegged USC cheaply, then exploited a redemption function that assumed USC was worth $1 without checking its market price. They redeemed the tokens for full-value collateral, nearly draining the protocol’s reserves.
Goose FinanceDeFi ProtocolBSC$8.44K
A flaw in Goose Finance’s vault share accounting let the attacker repeatedly deposit and withdraw before rewards were settled, creating shares worth more than they should have been. The attacker redeemed them after the harvest and profited.
Panther ProtocolDeFi ProtocolBase$7.58K
A malicious governance proposal exploited Panther Protocol on Base, causing a loss of about $7,578. No further details were reported.
Arrakis V1DeFi ProtocolEthereum$7.1K
An attacker used a flash loan to distort the ENS/WETH pool’s spot price, which the Arrakis vault used to value shares without a price check. After restoring the price, they redeemed the shares for a more valuable mix of tokens, profiting about 2.94 WETH.
BitmorDeFi ProtocolBase$6K
An access-control flaw in Bitmor’s DCA contract on Base let attackers drain tokens from wallets whose owners had active approvals for the contract.
OMNI404$5.92K
OMNI404 mishandled small transfers, treating them as NFT identifiers while still transferring a full token unit. The attacker used flash loans and Uniswap V3 swaps to exploit the mismatch and drain about 2.4 WETH.
The X account of crypto KOL Jadoodoo$5K
An attacker took over crypto commentator Jadoodoo’s X account and sent followers phishing links disguised as collaboration offers. Multiple crypto influencers were affected, with reported losses of about $5,000.
Veil CashDeFi ProtocolBase$5K
A misconfigured proof verifier in Veil Cash’s older privacy pools let the attacker forge withdrawal proofs and take about 2.9 ETH without depositing. Whitehat responders and the attacker returned the funds; the newer pools were unaffected.
VergeX$3.69K
Attackers targeted the VergeX trading platform, triggering withdrawal verification emails for some users. Risk controls stopped the incident quickly, the affected USDC was returned, and other users’ funds were unaffected.
Bodega MarketDeFi ProtocolCardano$3.6K
A vulnerability in Bodega Market’s prediction-market contracts let an attacker drain rewards and market seed funds. The underlying flaw has not been confirmed.
Quicksilver ZoneDeFi ProtocolQuicksilver$3.5K
A flaw in proof checking let an attacker forge proofs and mint about 505,000 qATOM and 10 million qOSMO without backing. The chain was halted, and the reported actual loss was limited to about $3,500.
ApeBond$3.42K
A flaw in ApeBond’s ApeYieldVault let an attacker use duplicate pool IDs to inflate a token lock, unlock and claim the inflated amount, then sell ABOND. After repaying a flash loan, the attacker kept about 5.72 WBNB.
StartaleDeFi ProtocolEthereum$2.88K
A flaw in Startale smart-account initialization let an attacker reinitialize pre-funded accounts during deployment with malicious code and transfer out their assets. About 330 accounts were affected; the Soneium network was not.
LNbitsWalletBitcoinLightning Network$1.7K
Attackers exploited vulnerabilities in LNbits installations to create unauthorized accounts and withdraw funds. The precise method and total losses were not yet known; LNbits told operators to shut down servers and later released a security update.
CofferDeFi ProtocolSolana$1
Coffer’s BTC pool rounded tiny deposits down to zero but still issued liquidity-provider tokens. An attacker repeated the deposits to obtain shares without equivalent assets, diluting existing providers; the pools were paused and later fixed.
Across ProtocolDeFi ProtocolBridgePlasmaUndisclosed
A social-engineering attack on Across Protocol’s domain registrar let an attacker redirect the site to a phishing page that tricked some users into wallet interactions and unauthorized withdrawals. The stolen amount was undisclosed, and Across pledged to compensate affected users.
SwarmUndisclosed
Attackers published a malicious Bee JavaScript package and a trojanized Swarm Desktop update. The malware targeted node settings and wallet keystores, sent the data to attackers, and installed a remote-access backdoor; no fund losses were confirmed.
FLOKI Trading BotUndisclosed
The FLOKI team reported an exploit in its Telegram trading bot and took the bot offline. The attack’s method and losses were not disclosed; the team said it was identifying affected users and securing remaining funds.
LoopscaleDeFi ProtocolSolanaUndisclosed
Loopscale reported a campaign of malicious API requests that exploited misconfigured asset-pricing settings to obtain undercollateralized loans and attempt outsized redemptions from its SOL and USDC vaults. The protocol said affected vaults were made whole and user deposits suffered no losses.
Diamante ($DIAM)Undisclosed
Using stolen company access keys, an attacker took control of Diamante’s token contract on BNB Chain and minted 161 million unauthorized DIAM tokens. Exchanges froze some of the tokens, and the team secured the contract with a new MPC wallet.
Zilliqa X-BridgeDeFi ProtocolBridgeZilliqaUndisclosed
A security incident affected Zilliqa’s X-Bridge and ZRC2 proxy contracts linked to some liquidity pools, affecting tokens including zUSDT, SEED, kUSD, and Zoge. Native ZIL and the Zilliqa EVM network were reported unaffected.
ChainstackUndisclosed
An attacker entered Chainstack’s development environment through a Grafana instance with default credentials, then reached parts of production systems. They accessed a customer account database and systems holding node credentials, but customer-facing services remained unaffected.
