Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
Myriad MarketsDeFi ProtocolBSCUndisclosed
An attacker used a private key exposed through a flaw in a third-party library to access Myriad’s market-management wallet and manipulate 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permissions and said affected markets would be voided and users refunded.
SwellDeFi ProtocolEthereumArbitrumBase+1 chainsUndisclosed
An attacker gained control of about 30 Swell operational keys, drained wallet balances, manipulated swETH and rswETH exchange rates with false reserve data, and redirected reward claims. Malicious upgrade contracts capable of draining about 2,513 ETH had been deployed but were not approved or executed.
GarudaDefiDeFi ProtocolTerra ClassicUndisclosed
Attackers repeatedly breached Garuda DeFi systems on Terra Classic, using malicious contract changes and compromised developer wallets to take user assets and rewards. They also inserted harmful wallet-approval prompts on the website; 1,114 NFTs and staking tokens were affected, with total losses undisclosed.
Based Visa Card Internal DashboardUndisclosed
An unauthorized party accessed an internal dashboard for the Based Visa Card program, potentially obtaining some cardholders’ names, identification numbers, birth dates, and addresses. Card details, funds, and wallets were not affected.
Microsoft’s official X accountUndisclosed
Attackers accessed Microsoft’s official X account and used it to promote an unauthorized Clippy meme coin to followers. Microsoft secured the account and removed the posts, saying it had not authorized the token.
The personal X account of Nano Labs founder Jack KongUndisclosed
An attacker took over Nano Labs founder Jack Kong’s personal X account and used it to promote a fake AI trading token. Nano Labs said it had not issued or endorsed the token and warned users not to follow the posts’ links or send funds.
BV-7XWalletRobinhood ChainUndisclosed
Phishing approvals compromised two BV-7X team wallets, allowing an attacker to transfer tokens using Permit2, a token-authorization system. An approval remained active and enabled a further large transfer after liquidity was moved into an affected wallet; the team later began a token migration.
Blink WalletUndisclosed
A software flaw let an attacker access and empty a few dozen Blink Wallet custodial accounts. Blink paused services, patched the flaw and later restored affected balances; non-custodial wallets and most funds were unaffected.
MultiversXChainMultiversXUndisclosed
A virtual-machine flaw allowed invalid state changes on MultiversX. Validators paused the network while preparing a fix and recovery from a known-good checkpoint; a restart attempt failed, leaving the mainnet paused.
PermapodDeFi ProtocolZIGChainUndisclosed
Permapod said an exploit affected its smart contracts and halted the protocol after securing the affected contracts. It has not disclosed the flaw, how it was exploited, or the amount lost.
Surf LendingDeFi ProtocolCardanoUndisclosed
A machine with access to Surf Lending’s admin key was compromised, though the team said no smart-contract bug was involved. Surf moved user vaults and supplied assets to its multisig treasury while it worked to secure the infrastructure and restore its V1 contracts.
RavencoinChainRavencoinUndisclosed
The Ravencoin network was affected by a missing input-validation issue. The loss amount and further details were not disclosed.
Hyperliquid MalaysiaWalletSolanaUndisclosed
An attacker used a compromised private key to drain a wallet associated with Hyperliquid Malaysia on Solana. The amount taken was not disclosed.
ZEUSUndisclosed
ZEUS’s infrastructure was attacked, but the incident was mitigated and no customer funds were lost or at risk. Services were temporarily taken offline for a security audit; there was no evidence of a Lightning node software flaw.
Yield YakUndisclosed
Malicious code was injected into Yield Yak’s vote.yieldyak.com subdomain. The code could put visitors’ assets at risk of theft.
GitcoinUndisclosed
Attackers compromised Gitcoin’s files.gitcoin.co subdomain and added malicious code designed to steal cryptocurrency from visitors’ wallets. The incident affected the website front end, not an on-chain smart contract.
Phala CloudUndisclosed
A flaw in Phala Cloud’s API let an attacker modify some off-chain key-management virtual machines and install a script that may have accessed decrypted environment variables after startup. The issue was patched and contained.
Roaring Kitty‘s X accountUndisclosed
Attackers apparently took over Keith Gill’s verified X account and used it to promote a Solana meme coin, briefly driving its market value higher before the posts were deleted and the price crashed. More than 80 wallets reportedly lost about $2.86 million.
LitecoinChainLitecoinUndisclosed
A flaw in Litecoin’s MWEB transaction validation let attackers create malformed transactions that some outdated nodes accepted, enabling unauthorized withdrawals from the peg. The chain was reorganized by 13 blocks to fix the issue.
VercelUndisclosed
A compromise of AI platform Context.ai gave an attacker access to a Vercel employee’s Google Workspace account, from which they escalated access. They also identified environment variables marked as non-sensitive; Vercel said customer variables encrypted at rest were protected.
DNS registrar for eth.limoUndisclosed
The DNS registrar for eth.limo was attacked, prompting a warning to avoid eth.limo-related pages until the issue was confirmed resolved. The reports did not specify any stolen funds.
HypurrFiUndisclosed
HypurrFi’s website domain was hijacked, but the protocol, user funds, and team infrastructure were reported unaffected. The team moved its website to a different domain.
AdobeUndisclosed
Adobe was reported to be investigating a suspected cyberattack that may have exposed data belonging to about 13 million users. The reported leak could include support-ticket information, but the details were not confirmed.
Trust WalletUndisclosed
Trust Wallet’s Discord vanity link was hijacked and redirected users to a phishing server. The report did not describe any funds being stolen.
axios npm packageUndisclosed
A malicious dependency introduced harmful code into version 1.14.1 of the axios npm package, creating a software supply-chain attack. The report did not state that funds were stolen.
Arf's official X accountUndisclosed
Arf’s official X account was reported compromised. Huma Finance warned people not to interact with its posts until the account was secured.
Steakhouse FinancialUndisclosed
A phone-based social engineering attack against Steakhouse Financial’s cloud provider led to changes to the DNS records for its website and app, redirecting them to a malicious address. The changes were reversed; vaults, smart contracts and depositor funds were unaffected.
VTSwapHookDeFi ProtocolArbitrumUndisclosed
A pricing error in VTSwapHook used midpoint estimates instead of correctly integrating the trading curve, while fee-accounting bugs inflated virtual reserves. The incident report does not specify how much was taken.
LiteLLMUndisclosed
A supply-chain attack on the LiteLLM package distributed through PyPI could steal sensitive data from systems where the package was installed, including credentials, API keys, and crypto-wallet data. The report did not specify stolen funds.
MoonwellUndisclosed
An attacker bought enough MFAM tokens to pass an initial Moonwell governance vote that could transfer control of lending markets and other components to a malicious contract. No funds were reported taken, and voting was ongoing, with opposition votes then leading.
UdonFi LendingDeFi ProtocolChromiaUndisclosed
A flaw in UdonFi Lending’s withdrawal function let an attacker take funds without proper authorization. The team said the assets remained on Chromia and offered a bounty for returning most of them; the total loss was not disclosed.
NeutrlDeFi ProtocolEthereumUndisclosed
Attackers socially engineered Neutrl’s domain provider and redirected the official website to a malicious interface that prompted users to approve token transfers. Reports said no funds were stolen.
BitrefillUndisclosed
A compromised employee laptop let an attacker access parts of Bitrefill’s databases and cryptocurrency wallets, exposing purchase records and limited customer information. The report did not specify stolen funds.
WLFIUndisclosed
Attackers reportedly compromised several WLFI co-founders’ accounts and used paid influencers to spread negative claims while shorting WLFI, in an attempt to profit from market turmoil. WLFI said the effort failed and USD1 remained stable.
Arbitrum GovernanceUndisclosed
Arbitrum Governance’s official X account was compromised. No stolen funds were reported.
SolarUndisclosed
Solar, the official Solana Mandarin community, suspected its X account had been compromised and said it had lost access. The report did not describe any stolen funds.
ScrollUndisclosed
An attacker compromised the X account of Scroll co-founder @shenhaichen. Scroll said it was working to recover the account and warned users against interacting with its links or direct messages.
ParadexUndisclosed
An attacker compromised the Mithril trading bot’s internal systems and exposed about 57 Paradex user subkeys. The keys allowed trading but not withdrawals; Paradex revoked the affected keys and paused XP transfers.
Darren Lau's X accountUndisclosed
Hackers took control of Darren Lau’s X account. The compromise report did not describe any funds stolen or other on-chain activity.
Bitlight Labs X AccountUndisclosed
Bitlight Labs’ X account was suspected of being compromised and posted content promoting a meme token. The report did not specify any stolen funds.
