Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Unleash ProtocolDeFi ProtocolStory$3.9M
An attacker manipulated Unleash Protocol’s multisig governance controls to upgrade its contract and transfer user assets, including WIP, USDC and WETH. About $3.9 million was stolen and moved to Ethereum; Story Protocol itself was unaffected.
MSCSTDeFi ProtocolBSC$130K
A missing permission check in MSCST’s reward-release function let an attacker use a flash loan to manipulate the GPC token’s price on PancakeSwap. The attacker made about $130,000 in BNB.
FlowLayer 1Flow$3.9M
An attacker exploited Flow’s execution layer to mint FLOW tokens and move assets, including WBTC, WETH and stablecoins, off the network. The assets were worth about $3.9 million; existing user balances were unaffected.
Our coverage: Flow Recovers Fast: $3.9M Breach Contained, Protocol Fix DeployedSource
Debot$255K
DeBot users’ private keys were reportedly compromised, allowing an attacker to steal funds; theft was still ongoing when reported. The team later said it had processed compensation applications.
FilDADeFi ProtocolElastos$167K
An attacker manipulated prices used by FilDA’s lending oracle on Elastos, distorting asset values and draining more than 140,000 ELA and 5,800 USDC. FilDA suspended its Elastos deployment and said it would shut it down permanently.
Trust WalletWalletEthereumBitcoinSolana$8.5M
A malicious Trust Wallet browser extension update stole users’ private keys, allowing attackers to access affected wallets. About $8.5 million was lost.
Rari CapitalDeFi ProtocolEthereum$2M
An unprotected proxy upgrade let an attacker take control of Rari Capital’s implementation contract and gain admin privileges. They used that access to borrow without collateral from its lending pools.
ICRYPEX GlobalUndisclosed
A security alert identified a potentially critical vulnerability at ICRYPEX Global, but the report did not say whether it was exploited or whether funds were lost.
Yearn Finance V1DeFi ProtocolEthereum$300K
An attacker used a donation attack against Yearn’s legacy V1 TUSD vault, depositing tokens to inflate the vault’s share price and minting Yearn TUSD tokens cheaply before the price fell. About $300,000 was lost; the attacker converted the funds to ETH.
FutureswapDeFi ProtocolEthereum$270K
An attacker used flash loans—temporary borrowed funds—to gain voting power and pass a malicious Futureswap proposal, granting an attack contract permission to transfer tokens from users.
AzbitmUndisclosed
SlowMist warned Azbitm that it had detected a potential vulnerability. The report did not say whether funds were taken.
Aevo$2.7M
A smart contract upgrade vulnerability enabled an attack on Aevo’s legacy Ribbon DOV vault. The attacker manipulated its price oracle—the system supplying price data—and drained about $2.7 million.
Mars PerpsDeFi ProtocolNeutron$960K
An attacker exploited Mars Protocol’s Perps market on Neutron by repeating same-block trades that took advantage of funding rates being applied only between blocks. The attack caused losses of about $973,000.
RibbonDeFi ProtocolEthereum$2.7M
An oracle upgrade left Ribbon’s legacy vaults using mismatched price decimals. The attacker exploited a publicly callable price-setting function and low collateral requirements to open undercollateralized positions and drain $2.7 million.
ZEROBASEDeFi ProtocolBSC$250K
A malicious BSC contract impersonating ZEROBASE tricked users into approving USDT transfers, then used those approvals to drain hundreds of wallets. The stolen funds were moved to an Ethereum address.
0G FoundationDeFi Protocol0G$516K
An attacker exploited the emergency-withdrawal function in 0G Foundation’s reward contract to take 0G tokens, ETH, and USDT. The stolen funds were later moved through a crypto-mixing service; the core chain and user funds were reported unaffected.
AlmanakUndisclosed
Operational errors and a DDoS attack disrupted Almanak’s airdrop claims and wallet deployment. About 1,100 users saw a pending status, but the team restored service, cleared the backlog, and said users’ tokens were safe.
USPD$1M
An attacker seized administrator control of USPD’s proxy during deployment, hiding malicious code that was later used to mint unauthorized tokens and drain liquidity, including stETH. The team said it is tracing the funds.
US Permissionless DollarDeFi ProtocolEthereum$1M
An attacker claimed the USPD protocol’s admin role during deployment and installed a malicious proxy contract, later minting 98 million USPD and draining about $1 million in stETH.
PEPEUndisclosed
Attackers altered PEPE’s official website code to redirect visitors to a malicious page. The report did not identify any stolen funds.
ReactUndisclosed
Attackers exploited a React vulnerability that allowed code to run remotely without authorization, injecting code into websites to steal funds from cryptocurrency wallets. The React team released a patch and urged affected users to upgrade.
GoldfinchDeFi ProtocolEthereum$330K
A flaw in Goldfinch’s legacy contract let an attacker use a user’s token approval to transfer funds. The attacker manipulated the share price and withdrew more than they were entitled to, then sent some proceeds to Tornado Cash, a privacy mixer.
Yearn FinanceDeFi ProtocolEthereum$9M
An accounting flaw in Yearn’s yETH pool let an attacker mint an enormous amount of yETH and swap it for legitimate assets, draining about $9 million. Some funds were later recovered, including through the burning and replacement of pxETH.
UpbitCEXSolana$36M
Upbit’s Solana hot wallets were drained after a weakness in its signing setup could allow private keys to be inferred from transaction history. The exchange suspended transfers, tracked the stolen assets, and reported that some funds had been frozen.
Agentic FoFDeFi ProtocolEthereum$531K
A security vulnerability allowed attackers to drain funds from Agentic FoF vaults. The protocol suspended its vaults and paused withdrawals during an investigation.
Port3 NetworkDeFi ProtocolBridgeBSC$166K
A flaw in Port3’s cross-chain bridge allowed an attacker to mint 1 billion unauthorized PORT3 tokens. The attacker sold some for about 199.5 BNB, while the remaining unsold tokens were burned after the project removed liquidity.
Raga FinanceDeFi ProtocolHyperliquid L1$18.5K
No credible source in the incident reports documents a specific Raga Finance hack on this date.
AerodromeDeFi ProtocolEthereumOptimism$700K
Attackers hijacked the Aerodrome and Velodrome website domains through a registrar compromise and redirected visitors to phishing pages that solicited harmful token approvals and signatures. Users lost about $700,000; the smart contracts were not compromised.
GANA PaymentDeFi ProtocolBSC$3.1M
An attacker obtained GANA Payment’s private keys and used them to change reward rates and exploit the unstaking function, draining tokens. They moved some of the proceeds through Tornado Cash and a cross-chain bridge; some funds remained in an Ethereum address.
DMT 空投(@dexmaxai)$130K
During the DMT airdrop, users were tricked into signing token approvals that let attackers transfer their assets. More than $130,000 was stolen and bridged to Ethereum; most of it flowed to HitBTC.
Dexmax AITokenEthereum$130K
Attackers tricked people claiming the DMT airdrop into signing extra approvals, allowing transfers from their wallets. They stole more than $130,000 and bridged the assets to Ethereum, with most flowing through HitBTC.
WLFIUndisclosed
Some WLFI users’ wallets were compromised through phishing or leaked recovery phrases, rather than a flaw in WLFI’s platform or contracts. WLFI burned 166.67 million tokens from a suspected compromised wallet and reallocated the same amount to a secure address.
Nofx AIUndisclosed
A security issue in the NOFX AI automated trading system exposed some users’ wallet private keys and exchange and trading-platform API keys. Theft incidents were reported, but the report gave no total loss.
AftermathUndisclosed
Attackers took control of Aftermath’s X account. Users were warned not to interact with it until the team regained access.
Hyperliquid$4.95M
An attacker built a large leveraged POPCAT position and then withdrew buy orders that had supported its price, causing a sharp crash. The position was liquidated, leaving Hyperliquid’s liquidity provider with about $4.9 million in bad debt.
PolymarketDeFi ProtocolPolygonEthereum$500K
Attackers posted disguised phishing links in Polymarket comments, leading users to fake login pages that captured their credentials. They used compromised email-login accounts to drain user funds.
Impermax V3DeFi ProtocolBase$380K
An attacker manipulated the balance of low-liquidity cbBTC-tBTC pools on Impermax V3, causing the exchange rate to collapse and enabling excessive borrowing-token creation. The exploit drained about $380,000.
DRLVaultV3DeFi ProtocolEthereum$100K
The attacker borrowed USDC, bought WETH to inflate its Uniswap price, then triggered DRLVaultV3 to buy WETH at that price and sold the attacker’s WETH for a profit. A whitehat captured about $100,000 in USDC that was expected to be recoverable.
DIMODeFi ProtocolBridgeEthereum$40K
An attacker used a compromised developer key with authority to upgrade DIMO’s Wormhole bridge contract to withdraw 30 million DIMO tokens, then sold them. The proxy was reverted and ownership moved to a multisig.
MoonwellDeFi ProtocolBaseOptimism$1M
An incorrect Chainlink price for wrstETH made it appear worth about $5.8 million, allowing an attacker to use a flash loan and repeatedly borrow against it from Moonwell on Base and Optimism. The attack yielded about $1 million.
