Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
D3X AI$159K
An attacker manipulated the d3xat token’s spot price in a Uniswap V2 trading pair, which the D3X AI exchange contract relied on. The attack caused a loss of funds.
LevelUndisclosed
Attackers took over Level’s official X account and posted a fraudulent airdrop link. The report did not specify any stolen funds.
BtcTurkCEXEthereumAvalancheArbitrum+4 chains$48M
BtcTurk’s hot wallets were hit across seven blockchains after private keys were compromised, with reports estimating losses in the tens of millions of dollars. The exchange acknowledged unusual wallet activity and suspended deposits and withdrawals.
CoinbaseCEXEthereum$300K
MEV bots exploited overly broad token approvals that Coinbase’s corporate DEX wallet had granted to a 0x swap contract, using the permissions to drain tokens.
GrizzifiDeFi ProtocolBSC$61K
An attacker used multiple wallets to exploit Grizzifi’s reward calculations, which counted past investments rather than active ones, and claimed extra staking and referral rewards.
ODIN.FUNDeFi ProtocolICP$7M
Attackers inflated token prices in ODIN.FUN’s internal market by depositing worthless tokens and trading them, then withdrew 58.2 BTC. The protocol had no outside price check to catch the manipulation.
numa.DeFi ProtocolSonic$313K
The attacker used a flash loan to inflate NumaVault’s reported liabilities, driving down the collateral price and allowing them to liquidate under-collateralized positions. They then bridged ETH to Ethereum.
CredixDeFi ProtocolSonic$4.5M
An attacker gained administrator access to Credix on Sonic and minted unbacked acUSDC tokens, then used them to drain about $4.5 million from pools. The funds were moved to Ethereum through Tornado Cash.
SuperRareDeFi ProtocolEthereum$730K
A faulty permission check let anyone change the Merkle root used by SuperRare’s staking contract, enabling fraudulent token claims worth about $730,000. A frontrunner later took over the exploit.
WOO XCEXBitcoinEthereumArbitrum+1 chains$14M
A phishing attempt tricked a WOO X team member into opening a malicious development tool, compromising their device and the development environment. Attackers then made unauthorized withdrawals from nine user accounts across several blockchains.
SwarmsUndisclosed
An attacker took over a Swarms team member’s Discord account through a malicious direct message, then deleted channels and removed more than 300 community members.
Stepp2pDeFi ProtocolBSC$43K
A logic flaw in Stepp2p’s core smart-contract functions was exploited, causing a loss of about $43,000.
CoinDCXCEX$44.2M
A server breach exposed the private key for CoinDCX’s operational hot wallet, and the attacker stole about $44 million in corporate funds, moving assets from Solana to Ethereum. Customer funds in cold storage were unaffected.
VDS$13K
SlowMist detected what appeared to be an attack on VDS on BSC. The report did not describe how it happened or what happened to the funds.
BigONECEXBitcoinBSCEthereum+2 chains$27M
Attackers breached BigONE’s production systems and changed backend withdrawal logic to approve fraudulent withdrawals across five blockchains. About $27 million was stolen; no private keys were reported leaked.
Arcadia FinanceDeFi ProtocolBase$2.5M
Attackers used a malicious router, a contract that directs swaps, to exploit Arcadia’s asset-management contracts and drain user vaults. The loss was reported at about $3.6 million.
Pundi AI$6.57M
A vulnerability in Pundi AI’s token swap contract let an attacker front-run its deployment and mint 1 million unauthorized tokens. The team recovered about 87% of the affected funds and said it would cover the remaining loss of nearly $2 million.
PlasmaUndisclosed
An attacker compromised Plasma’s official X account and posted links that appeared legitimate but redirected users to a phishing site.
KintoDeFi ProtocolBridgeArbitrum$1.55M
A flaw in Kinto’s token contract let the attacker mint counterfeit K tokens without limit. They used the tokens to drain assets from lending pools and a trading pool.
GMXDeFi ProtocolArbitrum$40M returned$42M
A reentrancy flaw in GMX V1 let an attacker manipulate short positions and inflate GLP’s price, then redeem GLP for profit. The attacker returned the funds and received a $5 million bounty.
ZKSwapDeFi ProtocolBridgeEthereum$5M
A flaw in ZKSwap’s emergency bridge withdrawals meant the contract did not actually verify zero-knowledge proofs, cryptographic checks of transactions. The attacker forged withdrawal proofs to inflate their balance and withdraw assets.
TextureDeFi ProtocolSolana$2.2M
A vault access-control flaw let an attacker steal about $2.2 million from Texture’s lending protocol. After the project offered a bounty, the attacker returned $1.98 million and kept $220,000.
Peapods FinanceDeFi ProtocolEthereum$207K
A misconfigured oracle in a user-created Peapods pod let an attacker manipulate the WETH/aspLONGsUSDe price and inflate collateral values. The pod lost about $207,000.
BonkDAO$19.3M
An attacker used token-weighted governance voting to pass a proposal transferring BonkDAO treasury funds. The attack exploited the voting process, not a code flaw or leaked keys.
Summer Finance$6.04M
Summer Finance’s Lazy Summer vault counted an Ark scheduled for removal in its value after a stale asset was donated to it. This inflated the share price and let an attacker drain real liquidity from depositors.
SynthetixUndisclosed
Attackers took control of Synthetix’s main X account. Users were warned not to interact with links posted from it while the team worked to regain control.
RANTTokenBSC$204K
A flaw in RANT’s token burn function let attackers manipulate the burn process and steal about $204,000 from the protocol.
Future ProtocolDeFi ProtocolBSC$4.6M
A flash loan let an attacker buy FPC and manipulate its pool price. FPC tokens burned from the pool then distorted its reserves, allowing the attacker to extract about $4.6 million.
PANewsUndisclosed
Attackers compromised the PANewsCN X account. The report warned users against clicking links or interacting with recent posts; it did not report stolen funds.
ResupplyDeFi ProtocolEthereum$9.6M
The attacker donated tokens to manipulate the exchange rate in Resupply’s new vault, then used a tiny amount of collateral to borrow most of the vault’s funds. The exchange rate determines how many shares deposits or withdrawals represent.
MEV Bot$2M
A suspicious attack involving MEV bot 0xb5cb on BNB Chain caused losses of about $2 million; the reports give no further details on how it happened.
Silo LabsDeFi ProtocolEthereum$546K
An attacker exploited an unreleased leverage contract deployed for testing, using a manipulated swap parameter and approvals to borrow without proper checks. The stolen 224 ETH belonged to SiloDAO; user funds were not at risk.
CoinTelegraphUndisclosed
Attackers altered CoinTelegraph’s website to show a pop-up with fake airdrop information. No financial losses were reported.
CoinMarketCap$21.6K
CoinMarketCap’s website front end was compromised, affecting 76 accounts and causing $21,624 in losses. The platform said it would reimburse those users.
HackenOther$250K
A leaked private key with minting privileges let an attacker create about 900 million HAI tokens on Ethereum and BNB Chain and sell them, sharply driving down the token’s price.
Abstract ChainUndisclosed
Abstract Chain’s official X account was reportedly compromised and used to promote a fake “official token” scam. The report did not say that funds were stolen in a protocol exploit.
Bankroll NetworkDeFi ProtocolBinance Smart Chain$65K
Attackers exploited an integer underflow in the sell() function of abandoned BankrollStack contracts, manipulating dividend accounting through old token approvals. They drained funds from users who had previously used the contracts.
Mehdi FarooqUndisclosed
A fake Zoom meeting invitation led Mehdi Farooq to download a malicious software update, which was used to drain six of his crypto wallets.
a16zUndisclosed
Attackers briefly took over a16z’s X account and posted a token promotion and other fake content. The firm said those posts did not come from it.
NobitexCEXTronEthereumBSC+4 chains$82M
Compromised hot-wallet keys let attackers steal roughly $82–90 million from Nobitex across multiple blockchains. The attackers sent the stolen assets to inaccessible addresses, destroying rather than keeping them.
