Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
ZKsyncOtherzkSync Era$5M
An attacker used a compromised admin account to mint 111 million unclaimed ZK airdrop tokens through the sweepUnclaimed() function. The protocol and user funds were unaffected, and 90% of the stolen tokens were later returned.
KiloExDeFi ProtocolBSCBaseTaiko$6.75M returned$7.5M
KiloEx’s contracts accepted manipulated ETH/USD oracle prices across several chains, letting the attacker profit from trades opened at artificially low prices and closed at real prices. The stolen assets were later recovered.
AergoUndisclosed
A DDoS attack made Aergo’s official website unavailable. The report described a service disruption, not a loss of funds.
Jake Gallen$100K
After a suspicious Zoom interview, an attacker posing as a YouTube creator used Zoom’s remote-access settings to install malware on Jake Gallen’s computer. More than $100,000 in Bitcoin and Ethereum was stolen.
MEV Bot$210K
A MEV bot lost approximately 116.7 ETH because its system lacked access controls.
Next Earth$17K
The NFT project Next Earth suffered a reentrancy attack on Polygon; the report provides no details about the amount taken or what happened to the funds.
Tenderize V2DeFi ProtocolEthereum$10.9K
A flaw in Tenderize V2’s proxy upgrade validation was exploited, causing a small loss on Ethereum.
AIRWADeFi ProtocolBSC$33.6K
An access-control flaw in AIRWA on BNB Chain let an unauthorized attacker extract funds from the protocol; the amount taken was not reported.
UPCXDeFi ProtocolEthereum$70M
Using a compromised private key, an attacker upgraded UPCX’s ProxyAdmin contract and used an admin withdrawal function to move 18.4 million UPC from three management accounts. UPCX later said it still controlled the tokens while it investigated.
ZapperDeFi ProtocolEthereumArbitrumOptimism+2 chains$7.9M
Attackers used social engineering to compromise Zapper’s .fi domain registrar and redirect visitors to a malicious site that sought credentials and enabled unauthorized transactions. Zapper told users to use zapper.xyz while it worked to recover the domain.
SIR.trading$355K
An attacker exploited a flaw in SIR.trading’s temporary storage: a value was not cleared after use, allowing a specially constructed address to bypass permission checks and transfer tokens. More than $300,000 in assets was lost.
SIRDeFi ProtocolEthereum$355K
A flaw in SIR.trading’s callback checks let an attacker use an address they controlled instead of the intended Uniswap pool. They exploited this to steal about $355,000.
Venus Core PoolDeFi ProtocolzkSync Era$902K
On zkSync Era, an attacker sent tokens directly to Venus Core Pool’s cToken contract, distorting exchange-rate calculations and bypassing collateral accounting. The attack caused losses and bad debt.
AlkimiyaDeFi ProtocolEthereum$95.5K
An attacker used a flash loan to exploit Alkimiya’s SilicaPools contract, where a conversion error made it record fewer shares than were issued. This allowed the attacker to redeem more collateral than they had deposited.
Min Token (MIN)$21.4K
Min Token was suspected of being attacked on BNB Chain, with an estimated loss of about $21,400. The attack details were not reported.
Vicuna LendingDeFi ProtocolSonic$700K
An oracle, which supplies price data, was manipulated to exploit Vicuna’s S Market and Stablecoin Market, causing about $700,000 in losses; its Main Protocol market was unaffected. Vicuna removed liquidity from the affected markets and planned to distribute remaining assets among affected users according to their net deposits.
AbracadabraDeFi ProtocolArbitrum$13M
An attacker used a flash loan to exploit a flaw in liquidation rules for Abracadabra lending pools that accepted GMX V2 liquidity-pool tokens as collateral. The attacker triggered liquidations and collected the associated incentives, taking about 6,262 ETH.
ZothDeFi ProtocolEthereum$8.85M
After gaining access to Zoth’s admin privileges, an attacker upgraded its contract to a malicious version and withdrew USD0++ stablecoins, swapping them into other tokens and ending up with 4,223 ETH.
Watcher.GuruUndisclosed
Watcher.Guru’s X account was hacked. The platform said it was investigating how the breach happened.
BBXTokenTokenBSC$12K
BBXToken’s transfer function burned liquidity pool tokens before updating the pool’s reserves. An attacker exploited this to distort the PancakeSwap pool and extract value.
Voltage FinanceDeFi ProtocolFuse$322K
An attacker replaced Voltage Finance’s SimpleChefStaking contract implementation with malicious code and used it to withdraw USDCE and WETH from its staking pools.
Four.MemeDeFi ProtocolBSC$80K
Four.Meme’s pre-launch transfer restrictions could be bypassed using a low-level function to create a PancakeSwap trading pair for tokens not yet launched. The attacker added liquidity at an unintended price and took pool funds.
WebKeyDAOTokenBSC$73K
An unprotected function let an attacker set WKEYDAO’s token price artificially low, buy tokens at one-tenth of market price, then sell them on a decentralized exchange for profit. A built-in cap limited how many tokens could be sold.
Kaito AIUndisclosed
Kaito AI’s founder and official X account were compromised, but no KAITO wallets were affected.
BerallyDeFi ProtocolBerachain$90K
A compromised Berally deployer key let the attacker sell vesting tokens and withdraw funds from a liquidity pool. The core dApp contracts were unaffected.
1inchDeFi ProtocolEthereum$5M
A flaw in 1inch’s older Fusion v1 resolver contracts let an attacker exploit an integer calculation error to impersonate resolvers and make unauthorized swaps, stealing USDC and wETH. Most of the funds were recovered after negotiations.
Pond.funDeFi ProtocolLinea$145K
Pond.fun’s lead software engineer was suspected of abusing privileged access to manipulate withdrawal functions and drain 64.8 ETH from liquidity pools. The funds were moved through Railgun and then to centralized exchanges.
MeowUndisclosed
Jupiter co-founder Meow’s X account was reportedly hacked and used to post token contract-address content; the posts were later deleted.
ZothDeFi ProtocolEthereum$285K
An attacker used flash loans to manipulate Uniswap V3 prices and exploit a flaw in Zoth’s collateral calculations, creating excess collateral value and borrowing ZeUSD against it.
Hegic(old contract)DeFi ProtocolEthereum$80K
An attacker exploited an old Hegic WBTC options pool withdrawal function that failed to reduce share balances. They deposited liquidity, bought put options, withdrew their liquidity, then exercised the options.
WemixDeFi ProtocolWemix$6.22M
An attacker stole authentication credentials for Wemix’s Nile NFT platform monitoring system and used them to access the Play Bridge Vault, making 13 withdrawals of 8.65 million WEMIX tokens. The tokens were sold on external exchanges.
PumpfunUndisclosed
An attacker took over Pumpfun’s X account and used it to promote fake tokens.
Suji Yan$4M
Mask Network founder Suji Yan reportedly lost more than $4 million in cryptocurrency in an apparent wallet hack.
InfiniDeFi ProtocolEthereum$49.5M
A former Infini developer who retained vault-draining privileges used admin access to drain the contract. The stolen USDC was converted into ETH.
Unverified_35bcDeFi ProtocolBSC$6.7K
An attacker exploited an unverified BSC contract by repeatedly triggering a function that transferred funds before updating its records. The amount taken was not specified.
BybitCEXEthereum$1.4B returned$1.4B
Attackers tricked Bybit signers into approving a masked transaction that changed the hot wallet’s security rules, using a spoofed Safe interface. This enabled the theft of over $1.4 billion in ETH and other assets.
IoTeX$4.4M
A compromised private key gave an attacker full administrator control of IoTeX’s ioTube bridge, which was drained of $4.4 million. The attacker also minted two tokens; IoTeX said most were frozen or worthless.
StepHeroNFTsDeFi ProtocolBSC$90K
A reentrancy flaw in StepHeroNFTs’ referral-claim function let an attacker trigger repeated transfers before the contract updated its records, draining funds.
CardexDeFi ProtocolAbstract$400K
A session signer key exposed in Cardex’s frontend let attackers impersonate users’ active sessions and drain funds from wallets that had approved session keys. About 9,000 wallets were affected.
ShawUndisclosed
Community reports said the X account of ai16z founder Shaw had been compromised. No stolen funds were reported.
