Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
zkLendDeFi ProtocolStarknet$9.55M
An attacker exploited rounding-down errors in zkLend’s withdrawal calculations, using precise wstETH deposits to inflate their account balance and drain tokens from other pools. About $3.2 million was returned after negotiations; the remaining funds were lost to a Tornado Cash scam.
Four.MemeDeFi ProtocolBSC$183K
Four.Meme’s migration process accepted an attacker-created PancakeSwap pool with a fake, inflated token price and did not check the price before adding liquidity. The attacker exploited the imbalance to drain WBNB.
Cashverse$108K
Cashverse appeared to be attacked on BSC, according to security monitoring. No further details were reported.
BankX$43K
BankX was reported to have been attacked on BNB Chain, Ethereum, and Optimism; the available report did not specify the method or outcome.
JupiterUndisclosed
JupiterDAO confirmed that its official X account was compromised; the notice warned users not to click links or copy contract addresses from it.
Mohammed Dewji MOUndisclosed
An attacker took over businessman Mohammed Dewji’s X account, falsely announced a TANZANIA token launch, and sold the token to investors.
Dr Mahathir MohamadUndisclosed
The X account of former Malaysian Prime Minister Dr Mahathir Mohamad was compromised and used to promote a fake token.
IonicDeFi ProtocolMode$8.6M
Attackers posed as Lombard Finance representatives and persuaded Ionic to accept counterfeit LBTC as collateral. They deposited 250 fake tokens to borrow real assets, some of which were bridged to Ethereum.
Sirio FinanceDeFi ProtocolHedera$2M
Sirio Finance was hit by a flash loan attack on Hedera, losing about $2 million. Public reports did not give details of the vulnerability.
The Tor ProjectUndisclosed
Hackers took over The Tor Project’s X account and used it to promote a fake token. No stolen funds were reported.
TIMEUndisclosed
TIME Magazine’s X account was allegedly compromised and used to post about the TIME token.
DogWifToolsOtherSolana$10M
Attackers took control of DogWifTools’ GitHub repository token and inserted malware into several software versions. The malicious updates stole users’ wallet private keys and cryptocurrency.
Dean NorrisUndisclosed
Hackers used Dean Norris’s compromised X account to promote a purported cryptocurrency launch, including a contract address and manipulated photo. After Norris confirmed the scam, the token’s value fell sharply.
AdsPower$4.7M
Hackers distributed malicious code that compromised some third-party browser extensions, in a breach discovered by AdsPower’s security team.
ODOS$100K
A lack of input checks in ODOS’s executor contract let attackers steal revenue held in the contract across multiple chains, causing about $100,000 in losses. ODOS said user funds were not affected.
Jair Messias BolsonaroUndisclosed
The X account of former Brazilian President Jair Bolsonaro was hacked and used to promote a token; the post was later deleted.
PhemexCEXEthereumSolanaXRP+10 chains$85M
Attackers compromised Phemex’s hot-wallet private keys and signing systems, draining wallets across multiple blockchains. Reported losses ranged from about $69 million to $85 million.
NasdaqUndisclosed
Attackers reportedly compromised Nasdaq’s official X account and used it to promote fraudulent meme coins. No stolen funds were reported.
AST$64.7K
AST was allegedly attacked on BSC, according to security monitoring. No further details were reported.
Dan FinlayUndisclosed
Dan Finlay’s Farcaster account was compromised and used to promote a memecoin.
ZKsync IgniteUndisclosed
The ZKsync Ignite X account was compromised. The team warned users not to interact with it or click its links while recovery was pending.
Stability AIUndisclosed
Stability AI’s official X account posted information about a STAI token contract that appeared to be part of a compromise and scam.
CAT ProtocolUndisclosed
CAT Protocol detected and stopped an attempted attack, with no user funds lost. The incident was later classified as a white-hat action.
DAWNUndisclosed
Hackers took over DAWN’s X account and used it to post phishing tweets. No stolen funds were reported.
The IdolsDeFi ProtocolEthereum$324K
A flaw in The Idols NFT reward logic mishandled transfers where the sender and recipient were the same address. An attacker repeatedly made such transfers to drain 97 stETH from the reward pool.
MoscaDeFi ProtocolBSC$37.6K
A flaw in Mosca2’s join() function let anyone inflate member balances instead of merely topping them up, enabling the attacker to drain the treasury.
MoonrayUndisclosed
Moonray’s Discord account was compromised and used to post fraudulent airdrop messages.
UniLendDeFi ProtocolEthereum$198K
An attacker used a flash loan to manipulate UniLend’s health-factor calculation, exploiting outdated balance data to withdraw stETH. The protocol lost about $197,000.
BUIDL$8K
BUIDL was suspected of being attacked on BNB Chain, with a reported loss of about $8,000; the available report gave no details on how it happened.
LitecoinUndisclosed
Litecoin’s X account was briefly compromised and used to publish unauthorized content, which was deleted within seconds. Litecoin said it found and removed a compromised delegated account and was investigating.
Ryan ZarickUndisclosed
Ryan Zarick’s X account was briefly taken over and used to post a fake airdrop claim with a phishing link.
Foresight VenturesUndisclosed
The Foresight Ventures X account was hacked, and the company began working to recover it.
Aizel NetworkUndisclosed
Hackers compromised Aizel Network’s official X account, which was being recovered. The team warned users not to trust token claims or click suspicious links.
SuperVerseUndisclosed
SuperVerse’s X account was compromised and used to post a fake airdrop claim with a phishing link.
Alien Base$38K
Multiple attacks on Alien Base’s BunniHub contract caused losses of about $38,000; the reports did not specify how the contract was exploited.
FortuneWheel$21.6K
FortuneWheel was suspected of a price-manipulation attack on BNB Chain, with a reported loss of about $21,600.
Holoworld AIUndisclosed
Holoworld AI founder Tong said the project’s X account had been hacked; the account was used to post links.
MobyDeFi ProtocolArbitrum$1.47M
An attacker took control of the key used to upgrade Moby’s contracts and used a malicious upgrade to steal assets from liquidity pools. A whitehat recovered about $1.47 million of the stolen funds.
Orange FinanceDeFi ProtocolArbitrum$840K
An attacker exploited Orange Finance’s misconfigured multisig, took control of its vaults, changed their contract code, and withdrew deposited assets and funds covered by excessive approvals.
HORS$10.3K
HORS was suspected of being attacked on BSC, with an estimated loss of about $10,300.
