Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Virtuals ProtocolUndisclosed
Virtuals Protocol’s official Discord account was compromised. The team warned users not to interact with posts or private messages from administrators.
IPC$590K
IPC was suspected of being attacked on BSC, resulting in an estimated loss of about $590,000.
IPC AITokenBinance$590K
An attacker used a flash loan to bypass IPC AI’s flash-loan protections and exploit the token pair’s burn mechanism. The attack drained about $590,000 from the liquidity pool.
MoscaDeFi ProtocolBinance$37.6K
A flaw in Mosca’s withdrawal function cleared one user balance field but left two others unchanged, allowing an attacker to withdraw the same funds repeatedly. The reported loss was about $19,500.
Solv ProtocolUndisclosed
Solv Protocol’s official X account was compromised; the available report did not describe any resulting loss.
SorraDeFi ProtocolEthereum$41K
A flaw in Sorra’s staking rewards function failed to account for rewards already claimed. The attacker repeatedly withdrew to claim the same rewards before the contract updated its records.
BabylonUndisclosed
Babylon’s official X account was compromised and used to post tweets containing phishing links.
CentrifugeUndisclosed
Centrifuge’s official X account was compromised and used to post fake information.
0xScopeUndisclosed
The X account of Web3 knowledge graph protocol 0xScope was hacked. An investigation and account recovery were underway.
MoonhackerDeFi ProtocolOptimism$300K
An attacker used a flash loan and passed a malicious contract into MoonHacker’s loan-handling function, which did not validate it. This enabled unauthorized approval to transfer and drain USDC from the vault.
NoOnesDeFi ProtocolBridgeEthereumBinanceSolana+1 chains$7.9M
Attackers exploited a flaw in NoOnes’ Solana bridge relay, which processes cross-chain messages, to bypass validation and authorize unauthorized withdrawals across several blockchains. They made hundreds of small transactions.
LAURA$48.2K
LAURA was suspected of a contract attack on Ethereum, causing an estimated loss of about $48,200.
Superchain EcoUndisclosed
Superchain Eco’s X account was compromised and used to post phishing links.
FegexDeFi ProtocolBridgeEthereumBSCBase$1.07M
An attacker forged cross-chain messages that FEG’s SmartBridge accepted as withdrawal requests without verifying their source, draining funds across Ethereum, BSC, and Base.
FEG$1M
FEG was attacked through an integration issue involving the Wormhole cross-chain bridge, which handles messages and token transfers between blockchains. The attack caused losses of about $1 million.
Standing on Bizness (BIZNESS)$15.7K
Standing on Bizness (BIZNESS) appears to have suffered a reentrancy attack, in which a contract is called again before an earlier operation finishes, causing an estimated loss of $15,700.
BiznessDeFi ProtocolBase$15.7K
Bizness on Base was exploited through a reentrancy bug: the attacker repeatedly called contract functions before the protocol had updated its records, draining funds.
Yat SiuUndisclosed
Yat Siu’s social media account was compromised, and a hacker used it to promote a fake Solana token launch that Animoca Brands said was not official.
Vivek RamaswamyUndisclosed
Vivek Ramaswamy’s account was reported compromised amid rumors of a DOGE and USUAL collaboration.
zkPassUndisclosed
zkPass’s X account was compromised and used to publish phishing posts.
HarryPotterObamaSonic10InuTokenEthereum$243K
An attacker manipulated the liquidity pool’s reserves to distort the HarryPotterObamaSonic10Inu 2.0 token’s price, taking 84.7 ETH. The funds were later sent to Tornado, a service that obscures transaction trails.
SlurpycoinTokenBinance$3K
An attacker used a flash loan and sandwich trades to manipulate Slurpycoin’s price around its buyback mechanism, profiting from the token’s burn process. Reported losses were about $3,000.
AnthropicUndisclosed
Anthropic’s official X account appeared to be compromised and posted an unknown token contract address related to AI agents.
GemPadDeFi ProtocolEthereumBaseBSC$1.9M
Attackers exploited a reentrancy flaw in GemPad’s fee-collection function to repeatedly withdraw tokens from liquidity lockers using a vulnerable contract template deployed by multiple projects. About $2 million was lost across several networks.
BTC24H (BTC24H)DeFi ProtocolPolygon$85.7K
A flaw in BTC24H’s Polygon lock contract let anyone claim tokens without checking whether they were eligible. The reported loss was about $85,700.
Decentralized Finance (DCF)$8.8K
Decentralized Finance (DCF) was attacked on BNB Chain, resulting in an estimated loss of about $8,800; the reports did not explain the attack method.
DrakeUndisclosed
Drake’s X account was allegedly compromised and used to promote a Solana meme coin that was later confirmed to be a scam. The promotional posts were deleted.
JHY TokenTokenBinance$12K
A flaw in JHY Token’s dividend tracker recorded users’ balances as the liquidity-pool token balance, letting them swap more tokens than they owned and drain funds.
JHY (JHY)$11.2K
A suspicious attack on JHY’s BNB Chain contract resulted in a loss of about $11,200; the available report does not explain how it happened.
bnbs (bnbs)TokenBinance$20.3K
The BNBS token contract on BSC had a reentrancy bug: the attacker repeatedly called a function before the contract updated its records, draining about $20,300.
CloberDeFi ProtocolBase$500K
A reentrancy flaw in Clober’s Rebalancer let an attacker repeatedly read contract balances before they were updated, draining 133.7 ETH from its Base liquidity vault. The attacker used a malicious contract and a flash loan.
LABUBU TokenTokenBinance$12K
A flaw let an address transfer tokens to itself and inflate its balance. The attacker used a flash loan—a temporary loan repaid in the same transaction—to repeat the exploit, then swapped and moved the proceeds across chains and mixed them.
LABUBU (LABUBU)$11.9K
A suspicious attack on LABUBU on BSC resulted in a loss of about $11,900.
Haven ProtocolUndisclosed
A flaw in Haven Protocol’s range-proof checks let attackers mint illicit XHV tokens. Reports indicated the supply exceeded 500 million tokens, and the team advised exchanges to halt trading.
Cardano FoundationUndisclosed
The Cardano Foundation’s X account was reported compromised, and users were advised to ignore its posts temporarily.
MAATDeFi ProtocolBinance$168K
A flaw in MAAT’s BSC Stargate withdrawal logic left a tiny share balance that let outsiders redeem funds without using up their shares. The breach led to unauthorized withdrawals of USDT.
ArataUndisclosed
Arata reported that its ecosystem and centralized exchange wallet were exploited, and the hacker sold a significant portion of the project’s tokens.
Vestra DAODeFi ProtocolEthereum$500K
A flaw in Vestra DAO’s staking contract let an attacker repeatedly claim rewards from positions that had already been unstaked. They took 73.72 million VSTR tokens, which were later sold for ETH.
RunWay (BYC)$100K
RunWay (BYC) appears to have been attacked on BNB Chain, causing an estimated loss of about $100,000; the report did not specify how.
BYC TokenTokenBinance$100K
On BSC, an attacker manipulated BYC’s auto-burn settings through large swaps, then used the function to reduce the token reserve in the liquidity pool and drain its USDT.
