Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Stake Nova$137K
An unchecked validation issue in Stake Nova’s RedeemNovaSol function enabled a flash-loan exploit that drained the liquidity pool, taking about $137,000—roughly 95% of user deposits.
Ploutos MoneyDeFi ProtocolEthereum$390K
Ploutos Money mistakenly used a Bitcoin price feed to value USDC, letting an attacker deposit only 8 USDC and borrow about 187 ETH. The exploit drained roughly $390,000.
Holdstation$462K
Attackers compromised the distribution system for Holdstation’s DeFAI Smart Wallet app, leading to unauthorized transactions from some users’ wallets. The team confirmed losses of about $462,000 in USDT and pledged to compensate affected users; the smart contracts were not exploited.
DGLDDeFi ProtocolBridgeBase$250K
A flaw involving the DGLD cross-chain bridge let attackers mint more than 100 million unbacked tokens on Base and sell them. The project absorbed about $250,000 in losses; physical gold and existing backed tokens were unaffected.
WLFIUndisclosed
Attackers reportedly compromised several WLFI co-founders’ accounts and used paid influencers to spread negative claims while shorting WLFI, in an attempt to profit from market turmoil. WLFI said the effort failed and USD1 remained stable.
Yieldblox$11M
An attacker manipulated the price reported to Script3’s YieldBlox pool by pushing the illiquid USTRY token’s price up about 100 times on the Stellar DEX. The oracle treated the inflated price as real, enabling a $10.97 million drain.
Blend Pools V2DeFi ProtocolStellar$11M
An attacker sharply inflated the price of the thinly traded USTRY token, making it appear more valuable as collateral in YieldBlox DAO’s Blend V2 lending pool. The attacker borrowed about $10.2 million–$10.97 million in USDC and XLM; validators and Blockaid froze a large portion, while some USDC was bridged out.
LAXODeFi ProtocolBSC$190K
A flawed LAXO burn mechanism let an attacker use flash loans to burn tokens held by the PancakeSwap pool without updating its recorded reserves. The attacker manipulated swaps and extracted 487,000 USDT.
IoTeX’s ioTube bridgeDeFi ProtocolBridgeEthereum$4.4M
An attacker obtained the private key for ioTube’s Ethereum-side validator owner and used it to upgrade the bridge, bypassing its checks and taking control of asset contracts. They drained about $4.3 million in tokens, then converted and moved most of the funds.
Veil CashDeFi ProtocolBase$5K
A misconfigured proof verifier in Veil Cash’s older privacy pools let the attacker forge withdrawal proofs and take about 2.9 ETH without depositing. Whitehat responders and the attacker returned the funds; the newer pools were unaffected.
Velar PerpsDeFi ProtocolMezo$401K
An attacker exploited predictable oracle update timing in Velar’s BTC/MUSD perpetual market, using repeated trades to manipulate prices and drain about $401,000.
MoonwellDeFi ProtocolBase$1.78M
An oracle configuration error priced cbETH at $1.12 instead of nearly $2,200 on Moonwell, leading liquidation bots to seize 1,096 cbETH. The error left the protocol with about $1.78 million in bad debt.
Arbitrum GovernanceUndisclosed
Arbitrum Governance’s official X account was compromised. No stolen funds were reported.
CrossCurveDeFi ProtocolBridge$3M
CrossCurve’s bridge contract failed to verify the origin of cross-chain messages, allowing an attacker to forge messages and unlock tokens without matching deposits on other chains. About $3 million was stolen across multiple networks before the exploit was contained.
Step FinanceDeFi ProtocolSolana$40M
Attackers compromised an executive’s device and gained access to Step Finance treasury and fee-wallet signing credentials, stealing about $40 million. The team later recovered about $4.7 million in assets.
Our coverage: Step Finance Hack: $30M SOL Stolen, STEP Token Crashes 90%SourceRekt report
Revert LendDeFi ProtocolBase$50K
A missing safety check in Revert Lend’s Base vault let an attacker withdraw liquidity that still backed an active loan, leaving the vault with a worthless collateral NFT. Two attackers caused $50,101 in losses, mostly from Revert’s own funds.
PGNLZDeFi ProtocolBSC$100K
A flaw in PGNLZ’s burn mechanism let the attacker reduce the tokens recorded in a PancakeSwap pool without properly updating its reserves. The resulting price distortions enabled reverse swaps that siphoned about $100,000 in USDT from the pool.
SolarUndisclosed
Solar, the official Solana Mandarin community, suspected its X account had been compromised and said it had lost access. The report did not describe any stolen funds.
SwapNet$13.4M
An arbitrary-call flaw in SwapNet’s aggregator contracts let attackers use existing token approvals to make unauthorized transfers from users across four networks. About $13.43 million was drained; Matcha Meta and 0x core contracts were unaffected.
MatchaDeFi ProtocolBaseEthereum$13.4M
An exploit in the SwapNet aggregator used by Matcha Meta allowed attackers to make arbitrary calls against tokens users had approved, taking about $13.43 million from users on Base and Ethereum.
Aperture FinanceDeFi ProtocolEthereumBaseBSC$3.67M
A flaw in Aperture’s contracts let attackers misuse users’ existing token and liquidity-provider NFT approvals through unvalidated external calls, draining about $3.67 million across several chains. No private keys were compromised.
ScrollUndisclosed
An attacker compromised the X account of Scroll co-founder @shenhaichen. Scroll said it was working to recover the account and warned users against interacting with its links or direct messages.
SagaEVMChainSaga$7M
A flaw in SagaEVM’s Ethermint precompile let attackers bypass checks on IBC cross-chain messages and mint unbacked Saga Dollars. They moved about $7 million in assets before the chain was halted; Saga’s other chains were unaffected.
ParadexUndisclosed
An attacker compromised the Mithril trading bot’s internal systems and exposed about 57 Paradex user subkeys. The keys allowed trading but not withdrawals; Paradex revoked the affected keys and paused XP transfers.
MakinaFiDeFi ProtocolEthereum$3.41M returned$4.2M
An attacker used a flash loan and flaws in Makina’s share-price oracle to manipulate pool prices and extract about $4.13 million. Some funds were later returned, including about 920 ETH after a 10% bounty deduction.
SynapLogicDeFi ProtocolBase$144K
Flaws in SynapLogic’s referral and swap logic let attackers make invalid referrals and withdraw more native tokens than they paid in, while also minting SYP. The exploit involved repeated transactions and caused losses of about $186,000.
MeteoraDeFi ProtocolSolana$1.5M
Meteora lost $1.5 million in USDC after its team sent funds for a token buyback to a fake OTC escrow counterparty posing as a legitimate buyer. The counterparty never delivered the tokens.
YO ProtocolDeFi ProtocolEthereum$3.6M
YO Protocol’s automated rebalance had an extremely high slippage limit, removing price-movement protection. A trade routed through high-fee Uniswap pools returned only 112,036 USDC for 3,840,651 stkGHO; the multisig bought back the position that day.
FutureSwapDeFi ProtocolArbitrum$395K
A flaw in FutureSwap’s position accounting let an attacker manipulate the protocol’s collateral records and withdraw more than they had deposited. Reports disagree on the attack details and loss amount.
TruebitDeFi ProtocolEthereum$26.4M
An integer overflow in Truebit’s token-purchase code let an attacker mint TRU at negligible cost and sell it through the bonding curve. The attack drained about $26 million in value and caused TRU’s price to collapse.
Darren Lau's X accountUndisclosed
Hackers took control of Darren Lau’s X account. The compromise report did not describe any funds stolen or other on-chain activity.
PolyculeDeFi ProtocolPolygon$230K
Attackers breached the server used by Polycule’s trading bot, where users’ private keys were stored without encryption, and drained about $230,000 from affected users. The related bots were taken offline.
Fusion by IPOR$336K
A flaw in an older IPOR Fusion Vault allowed an attacker to make arbitrary external calls and extract about $336,000 in USDC. The funds were later recovered through a white-hat agreement, with the DAO covering a 10% bounty.
IPOR FusionDeFi ProtocolArbitrum$336K returned$336K
A flaw in IPOR Fusion’s withdrawal checks let malicious fuse contracts run arbitrary code through EIP-7702 delegation and drain about $336,000 in USDC from its Arbitrum vault. About $267,000 was moved to Tornado Cash.
USDGambit and TLPDeFi ProtocolArbitrum$1.5M
Attackers compromised the shared deployer account for USDGambit and TLP, then changed ProxyAdmin permissions to take control of both protocols and drain about $1.5 million. They bridged the funds to Ethereum and deposited them into Tornado Cash.
TMX$1.4M
A vulnerability in a contract related to TMX on Arbitrum was exploited in a loop involving minting and staking LP tokens, swapping USDT for USDG, then unstaking and selling more USDG. Estimated losses were around $1.4 million.
TMXTribeDeFi ProtocolArbitrum$1.4M
A flaw in TMXTribe’s calculation of its assets ignored USDG liabilities. The attacker repeatedly minted, staked and swapped tokens to inflate redemptions, draining funds from the protocol.
OLY$63.4K
A sandwich attack on BSC targeted OLY trades, placing transactions around a victim’s trade to profit from the resulting price movement. Estimated losses were about $63,400.
Bitlight Labs X AccountUndisclosed
Bitlight Labs’ X account was suspected of being compromised and posted content promoting a meme token. The report did not specify any stolen funds.
PRXVTDeFi ProtocolBase$97K
An attacker used many generated addresses to bypass per-address limits in PRXVT’s staking contract and claim rewards, draining about 32.8 ETH from the protocol.
