Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Balancer V2DeFi ProtocolEthereumArbitrumBase+3 chains$128M
A rounding flaw in Balancer V2’s stable-pool swap calculations let attackers manipulate pool values and withdraw assets for far less than they were worth. The exploit affected pools across several chains; mitigation efforts protected or recovered some funds.
Berachain$12.8M
Funds lost to a BEX/Balancer v2 vulnerability were returned to the Berachain Foundation’s deployer address, and the blockchain resumed normal operations.
Garden FinanceDeFi ProtocolBridgeEthereumArbitrumBase+1 chains$11.4M
Attackers compromised a Garden Finance solver, a service that handles cross-chain transactions, and used it to drain funds across Ethereum, Arbitrum, Base, and Solana. Losses were reported at about $10.8 million.
GMGN$10.3K
A phishing site posing as a third-party token website tricked GMGN users into triggering unauthorized transactions, affecting about 107 users. GMGN said affected accounts were secured and losses would be fully compensated.
402BridgeDeFi ProtocolBridgeBase$17.7K
A leaked private key compromised 402Bridge’s wallets, while excessive token approvals let the attacker take users’ USDC. The stolen funds were swapped for ETH and bridged to Arbitrum.
GMGNUndisclosed
An MEV sandwich attack affected 729 GMGN transactions, causing losses to users. GMGN later said it had calculated the losses and paid compensation to affected users.
NobleUndisclosed
An attacker compromised Noble’s official X account and used it to post phishing tweets.
DoodiPalsTokenSolana$171K
An attacker used a leaked DoodiPals private key to sell tokens from multiple wallets for about 917 SOL. The team said it planned to relaunch after an audit and compensate affected holders at a 1:1 rate.
Sharwa.FinanceDeFi ProtocolArbitrum$146K
Attackers exploited a flaw in Sharwa Finance’s margin-trading swaps by sandwiching their own trades—placing trades around a swap to manipulate its outcome—after borrowing assets with leverage. Two attackers took about $61,000 and $85,000 before the platform paused.
Astra NovaAI AgentEthereum$9.09M
A third-party market maker account used for Astra Nova’s token launch was compromised, letting the attacker sell tokens representing 8.6% of the supply for more than $9 million. The token price fell sharply, and the team said the funds remained in USDT on a centralized exchange.
Typus FinanceDeFi ProtocolSui$3.44M
A vulnerability in Typus Finance’s price oracle let the attacker set token prices to extreme values and drain assets from its TLP contract. Stolen assets included SUI, USDC, xBTC, and suiETH.
Astera.fiDeFi ProtocolLinea$573K
An attacker manipulated a lending market’s liquidity index—a measure used to calculate balances—to inflate collateral values and borrow assets from Astera’s Linea markets. Linea’s security team detected and stopped the attack within minutes.
Watt ProtocolUndisclosed
An attacker took over Watt Protocol’s official X account and used it to post phishing messages.
TokenHolderTokenBSC$26K
Missing permission checks in TokenHolder’s contract let an unauthorized caller use restricted functions to drain about $26,000.
MIN Spell$1.79M
A vulnerability in some deprecated MIN Spell V4 Cauldrons let an attacker mint MIM. The team fixed the flaw and bought back the affected MIM, offsetting the impact; other Cauldrons and user funds were not affected.
AbracadabraDeFi ProtocolEthereum$1.7M
A flaw in Abracadabra’s multi-action function let attackers bypass collateral checks and borrow MIM without enough backing, withdrawing 1.79 million tokens.
BNB Chain$8K
After BNB Chain’s English X account was compromised, attackers used phishing links to trick users into transactions, causing about $8,000 in losses. The links were removed, and user compensation was completed.
dTRINITYDeFi ProtocolSonic$56K
A missing authorization check in dTRINITY’s swap adapter let the attacker use addresses that had previously approved it. Malicious swap routes sent team members’ collateral to the attacker while returning just enough to pass checks.
HyperdriveDeFi ProtocolHyperliquid L1$782K
A vulnerability in Hyperdrive’s router allowed an attacker to make unauthorized calls and repeatedly withdraw USDT0 and thBILL from its markets. The losses totaled about $782,000, and funds were moved to Ethereum and BNB Chain.
HyperVaultDeFi ProtocolHyperliquid L1$3.6M
HyperVault’s developers drained about $3.6 million in user funds and disappeared, moving assets through privacy tools. They had falsely claimed the project was audited by Spearbit and Pashov.
SBI CryptoOtherBitcoinEthereumLitecoin+2 chains$21M
SBI Crypto’s hot wallets were drained of several cryptocurrencies, which attackers moved through five instant exchanges and into Tornado Cash, a transaction-mixing service. SBI Group did not publicly confirm the incident.
GriffinAIDeFi ProtocolBridgeBSC$3M
A misconfigured LayerZero bridge and compromised contract key let attackers set a fake peer and mint 5 billion unauthorized GAIN tokens on BSC. They sold about 150 million tokens for roughly $3 million before the price crashed.
SeedifyDeFi ProtocolBridgeBSCAvalanche$1.2M
An attacker used a compromised developer key to change Seedify’s bridge settings and mint unauthorized SFUND tokens, which were moved across chains and mostly sold on BNB Chain. About $200,000 was frozen at an exchange.
CorepoundDeFi ProtocolCORE$400K
Corepound’s team used privileged control of its vaults to withdraw about $400,000 in deposited user funds.
UXLINKDeFi ProtocolEthereumArbitrum$11.3M
Attackers gained control of UXLINK’s multisig, a wallet requiring multiple signers, and changed its owners without approval. They drained assets and minted UXLINK tokens, causing losses reported at more than $11 million.
New Gold ProtocolTokenBSC$1.9M
The attacker used a flash loan—a temporary loan repaid within one transaction—to manipulate a token-price calculation based on a trading pool’s reserves. This let them bypass purchase limits and obtain tokens at unrealistic prices; the stolen assets were moved to Ethereum.
YalaTokenSolanaEthereum$7.64M
An attacker used a temporary deployment key to create an unauthorized bridge, then used it to mint unauthorized YU tokens and extract funds. Thai authorities arrested a suspect, and most of the funds were recovered.
Shibarium BridgeDeFi ProtocolBridgeShibarium$4.1M
An attacker used a flash loan to gain control of most Shibarium validator power and get validators to approve a false network state, draining assets from the bridge. Reports differ on the loss, describing it as several million dollars.
Kame AggregatorDeFi ProtocolSei$1.3M
A flaw in Kame Aggregator’s swap function let attackers make unauthorized calls and transfer tokens users had approved for spending, especially users with unlimited approvals. Some funds were recovered by the team and whitehat hackers.
Evoq FinanceDeFi ProtocolBSC$420K
After stealing Evoq Finance’s owner key, an attacker transferred contract ownership, installed a malicious upgrade, and drained about $420,000 from the protocol and users’ approved token accounts.
SwissBorgCEXSolana$41.5M
Compromised API credentials belonging to SwissBorg’s staking partner Kiln let an attacker alter unstaking transactions and take withdrawal control. About 192,600 SOL, worth roughly $41.5 million, was stolen from SwissBorg’s SOL Earn program.
Nemo ProtocolDeFi ProtocolSui$2.59M
A publicly callable flash-loan function and a state-changing query function let an attacker drain Nemo Protocol’s Sui Market pool. The attacker then bridged the funds to Ethereum.
BunniDeFi ProtocolEthereumUnichain$8.4M
A rounding error in Bunni V2’s withdrawal logic let attackers withdraw more tokens than they were entitled to, draining about $8.4 million across Ethereum and Unichain.
OlaXBTDeFi ProtocolBSC$2M
A compromise of OlaXBT’s multisignature wallet led to the theft of AIO tokens. The team deployed a replacement token contract and migrated users’ holdings.
Cozy V2DeFi ProtocolOptimism$427K
A missing caller check in Cozy V2’s withdrawal function let an attacker complete withdrawals using only a user’s redemption ID, causing a loss of about $427,000.
BetterBankDeFi ProtocolPulseChain$5M
An attacker exploited BetterBank’s reward mechanism, using flash loans and manipulated liquidity pools to mint tokens and swap some for ETH. About $2.7 million was returned; the attacker cashed out about $1.4 million.
Panoptic V1.1DeFi ProtocolBaseUnichainEthereumUndisclosed
Researchers found a flaw in Panoptic V1.1’s position checks: its hash method could produce the same identifier for different positions. This could have let attackers bypass collateral checks and drain pools, but the flaw was reported before it was exploited.
Equilibria Finance$62.5K
A transferability setting in Equilibria’s stk-ePENDLE contract let an attacker repeatedly move tokens between addresses, triggering reward claims each time and draining about 13.36 ETH in unclaimed rewards.
ABCCApp$10.1K
An attacker reportedly exploited ABCCApp on BSC through an unprotected contract function that changed a value used to calculate claimable USDT. The reported loss was about $10,100.
Puffer FinanceUndisclosed
Puffer Finance’s website and official X account were reported compromised.
