Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Meta PoolDeFi ProtocolEthereum$130K
An unprotected public mint function in Meta Pool’s staking contract let an attacker create mpETH without depositing collateral. Low liquidity limited how much they could sell, and most of the minted tokens were not converted into funds.
FixedTokenBSwapDeFi ProtocolEthereum$2.2K
An attacker used crafted swap paths and a fake token that bypassed a transfer check to evade FixedTokenBSwap’s on-chain price check and extract fixed amounts of RTV in repeated transactions.
Echo ProtocolUndisclosed
Echo Protocol’s official X account was compromised. Users were warned not to interact with its recent posts or links.
ether.fiUndisclosed
Hackers took over ether.fi’s official Discord and posted scam links in fraudulent messages.
ALEX ProtocolDeFi ProtocolStacks$8.37M
A malicious token exploited a flaw in ALEX Protocol’s asset verification, allowing the attacker to impersonate the vault and drain multiple pools. Losses were about $8.37 million.
Force BridgeDeFi ProtocolBridgeNervos$3.9M
Force Bridge was exploited through privileged functions that lacked access controls, allowing attackers to drain assets across Ethereum and BSC. The Nervos team suspended the contracts and investigated reports of malicious code embedded in a locally built Docker image.
MegaETHUndisclosed
MegaETH’s X account was compromised. The team warned users not to click links or view recent posts from the account.
Malda$285K
A flaw in Malda’s Migrator contract let an attacker supply a malicious Comptroller, a contract that manages lending positions. They used it to create a synthetic position and withdraw about $285,000.
Cork ProtocolDeFi ProtocolEthereum$12M
An unprotected swap hook and weak checks let the attacker create fake market structures and token derivatives in Cork Protocol. They used them to drain wstETH from the protocol.
Usual ProtocolDeFi ProtocolEthereum$43K
An arbitrage attack exploited a flaw in Usual’s USD0++ vault, which allowed tokens to be exchanged at a fixed rate without properly checking the transaction. The attacker profited by selling USD0 elsewhere; the reported loss was about $43,000, with no user funds affected.
Dexodus FinanceDeFi ProtocolBase$300K returned$300K
An attacker used outdated but accepted Chainlink price data to open a 100-times leveraged ETH long at an artificially low price, then closed it at the correct price in the same transaction. Dexodus recovered all affected liquidity within 24 hours.
CetusDeFi ProtocolSui$223M
A math error in Cetus’s liquidity calculations let attackers create positions showing large amounts of fake liquidity with minimal deposits, then withdraw real pool assets. Sui validators froze some of the funds, while others escaped.
Nexo$31.5K
A lack of access controls in a Nexo contract enabled a sandwich attack, in which transactions are placed around a user’s trade to profit from its price impact. About $31,000 was lost.
IRYS AITokenBinance Smart Chain$69.6K
A backdoor admin function in the IRYS AI token contract let its deployer bypass normal permission checks and use the tax wallet to drain funds directly from users’ wallets.
Nitron$951K
An attacker used token donations to manipulate the price feed for Nitron’s deprecated dGLP vault, taking funds from its lending market.
DemexDeFi ProtocolArbitrum$951K
An attacker donated fsGLP to inflate the redemption rate used to price dGLP in Demex’s Nitron lending market, then used the falsely valued dGLP as collateral to borrow other assets.
Zunami ProtocolDeFi ProtocolEthereum$500K
An attacker used a compromised admin key to call a privileged withdrawal function and drain collateral backing Zunami’s zunUSD and zunETH stablecoins. The stolen funds were sent through Tornado Cash, a service that obscures transaction trails.
ZKsyncUndisclosed
The official X accounts of ZKsync and Matter Labs were compromised, and users were warned not to interact with them or click their links.
Sheffield UnitedUndisclosed
An attacker took over Sheffield United’s official X account and posted a Solana token address.
MobiusDAO$2.15M
A decimal-place bug in Mobius Token on BSC reportedly let an attacker mint 9.73 quadrillion MBU for a small amount, then sell the tokens and take about $2.15 million.
Mobius TokenDeFi ProtocolBSC$2.15M
A decimal-scaling error in Mobius Token’s minting function let an attacker create huge amounts of tokens and swap them for stablecoins, stealing about $2.15 million.
CointelegraphUndisclosed
Cointelegraph’s official X account was reportedly compromised and used to send contributors phishing links that led to a fake login page on a misspelled domain. Reports also said the account posted an on-chain token contract; that post was later deleted.
LNDDeFi ProtocolSonicHyperliquid L1$1.18M
A developer with sole control over deployments introduced a malicious access-control change that reached LND’s production system without review. The change allowed funds to be taken from the protocol.
BitoProCEXEthereumTronSolana+1 chains$11.5M
Social engineering led to malware being installed on a BitoPro cloud operations team member’s system, compromising the exchange’s hot wallets. Attackers withdrew assets across several blockchains and later laundered them through exchanges and other services.
Curve FinanceUndisclosed
Attackers took over Curve Finance’s X account to promote a fake airdrop, then hijacked its website frontend. Users were warned about the compromised site.
TRON DAOUndisclosed
An unauthorized party gained access to TRON DAO’s X account and used it to publish a post with a contract address, send private messages, and follow unknown accounts.
HyperliquidUndisclosed
Hyperliquid’s X account was suspected of being compromised; the report did not confirm any theft or losses.
QuantMasterDeFi ProtocolEthereum$100K
A malicious backdoor in QuantMaster’s smart contract let an insider developer extract funds, causing losses of several hundred thousand dollars. Project developer Thomson said code submissions pointed to a specific employee.
LIFE Protocol$51K
SlowMist reported that LIFE Protocol had been attacked and funds were lost. The report did not describe the attack method or what happened to the funds.
AventaDeFi ProtocolEthereum$7K
A flash loan—a temporary loan that must be repaid within one transaction—was used to exploit a vulnerability in Aventa and drain about 3.9 ETH from the protocol.
LoopscaleDeFi ProtocolSolana$5.8M
An attacker manipulated the price of RateX collateral to borrow more than it was worth, draining USDC and SOL from Loopscale. The stolen funds were later returned.
Term LabsDeFi ProtocolEthereum$1.65M
A decimal precision mismatch introduced during a tETH oracle update caused Term Finance to price the asset incorrectly and liquidate positions by mistake. The protocol recovered some of the affected ETH, leaving a net loss of about 362 ETH.
ImpermaxDeFi ProtocolBase$300K
An attacker manipulated liquidity-pool prices and fee accounting in Impermax V3, making collateral appear more valuable than it was and borrowing against it. The attack drained V3 liquidity pools.
GrafanaUndisclosed
An attacker injected malicious code into a fork of Grafana’s repository and stole access tokens, then used them to access four private repositories. The breach was limited to automation systems and did not affect production systems or released software.
ACBDeFi ProtocolBSC$22.8K
An attacker manipulated ACB’s spot-price feed on BNB Chain to inflate staking reward calculations, causing losses of about $22,000.
Bitcoin MissionDeFi ProtocolArbitrum$1.3M
An unauthorized caller exploited a wrapped-BTC handling function that lacked access checks, moving about $1.3 million in wrapped Bitcoin from Bitcoin Mission.
BitgetCEX$100M
Bitget’s market-making bot entered a predictable trading loop on the VOXEL/USDT futures pair. Traders used high leverage to extract about $100 million before Bitget froze accounts and rolled back trades.
NUMA.DeFi ProtocolArbitrum$506K
The attacker used flash-minted nuBTC to distort NUMA’s synthetic liabilities and collateral values, exploiting a lack of protection against spot-price manipulation. The stolen assets were swapped for ETH and sent through Tornado Cash.
R0ARDeFi ProtocolEthereum$780K
A backdoor in the R0ARStaking contract let someone falsify their recorded balance and withdraw the contract’s funds through its emergency withdrawal function.
DINUndisclosed
Hackers took over the X accounts of DIN, its founder, and the DIN Foundation. Posts from those accounts were not from the official team.
