Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
DeBox$275K
A private key for a DeBox operational wallet leaked, and attackers stole 31.03 ETH and 4.879 million BOX tokens.
GAGAW (GAGAW)$70K
GAGAW on BSC was suspected of being attacked, with funds lost.
BrettUndisclosed
Brett’s official X account was reportedly compromised and used to post false information.
Clipper DEXDeFi ProtocolOptimismBase$450K
A flaw in Clipper’s single-asset deposit and withdrawal feature let an attacker distort liquidity pools on Optimism and Base, then withdraw more assets than they had deposited. The pools lost about $458,000.
SpectralDeFi ProtocolEthereum$250K
A flaw in Spectral’s Syntax V2 bonding-curve contracts let an attacker use a flash loan and an unintended token approval to manipulate the pool’s pricing and remove liquidity.
XT ExchangeCEXEthereum$1.7M
An attacker compromised XT’s hot wallet and drained 12 types of tokens, then swapped them for 461.58 ETH. XT halted withdrawals and said user funds were covered by reserves.
NFTGDeFi ProtocolBNB Chain$10K
A flaw in NFTG’s BNB Chain access controls let unauthorized callers extract funds from the protocol.
DCF$440K
DCF on BNB Chain was exploited through an error in the token’s transfer logic, causing a loss of about $440,000.
Pump ScienceUndisclosed
An oversight left a wallet’s private key—the secret needed to control it—in Pump Science’s website source code. An attacker obtained the key and exploited the wallet.
Akashalife (AK1111)$31.5K
Akashalife’s BSC token was suspected of being attacked, with reported losses of about $31,500; the attack method was not specified.
Proxy_b7e1DeFi ProtocolBNB Chain$8.5K
A logic flaw in a proxy-based contract on BNB Chain was exploited, causing losses of about $8,500.
JRNY$4M
A wallet associated with crypto commentator JRNY was reportedly compromised, with about $4 million in assets transferred and sold. The report suggested the wallet’s private key may have leaked.
AK1111DeFi ProtocolBNB Chain$31.5K
An access-control flaw in the AK1111 contract let an unauthorized party withdraw funds, causing about $31,500 in losses.
Sweepr Token (SWEEPR)$14K
Sweepr Token on Ethereum was suspected of being attacked, with funds lost.
Matez (MATEZ)DeFi ProtocolBNB Chain$80K
Matez on BNB Chain was exploited through an arithmetic error that truncated numbers, causing losses of at least about $80,000.
MainnetSettlerDeFi ProtocolEthereum$66K
An approval flaw in MainnetSettler allowed attackers to make unauthorized contract calls and use transferFrom to take Hold tokens from users who had approved the contract. Losses were about $66,000.
BSCGem (BSCGem)$17.3K
BSCGem on BNB Chain was suspected of being attacked, with an estimated loss of about $17,300.
TectonicDeFi ProtocolCronosUndisclosed
The reported Tectonic hack could not be verified; searches found no credible reports or announcements of an incident on that date.
MFT (MFT)$33.7K
MFT on BSC was suspected of being attacked, with about $33,700 lost; the reports did not specify how the attack worked.
MFTDeFi ProtocolBNB Chain$33.7K
A logic flaw in MFT’s BNB Chain contract was exploited, causing losses.
DEXXWalletSolana$21M
Attackers gained access to private keys and drained funds from users’ DEXX wallets on Solana. At least 900 users were affected, with estimates of total losses ranging from $21 million to $30 million.
Polter FinanceDeFi ProtocolFantom$8.7M
A flash loan—borrowed funds that are repaid within one transaction—was used to distort the BOO price reported by Polter Finance’s oracle, letting the attacker take out oversized loans. The reports gave differing loss estimates.
Giggle AcademyUndisclosed
Binance co-founder CZ confirmed that the official X account of his educational project, Giggle Academy, had been hacked.
ThalaDeFi ProtocolAptos$25.5M
A missing balance check in Thala’s v1 farming contracts let an attacker withdraw $25.5 million in liquidity-pool tokens without owning them. Thala recovered $25 million within hours through negotiations.
GMGNUndisclosed
GMGN reported a malicious attack on its website, suspected to involve automated crawling and traffic-flooding methods. Some site features were temporarily affected and later restored; no stolen funds were reported.
dogwifcoin (WIF)Undisclosed
Dogwifcoin’s X account was suspected of being hacked and used to post messages about token contracts.
vETHDeFi ProtocolEthereum$447K
Attackers exploited vETH’s reliance on a price source they could manipulate to extract value from the Ethereum protocol. Reported losses were about $450,000.
DeltaPrimeDeFi ProtocolArbitrumAvalanche$4.8M
On Arbitrum and Avalanche, an attacker created a malicious trading pair and used it to turn borrowed collateral into fake reward tokens, which they withdrew. The attack left DeltaPrime with unbacked debt.
zkFinanceDeFi ProtocolzkSync Era$200K
The reported zkFinance hack could not be verified; no credible sources documented an incident on that date or nearby dates.
BGMDeFi ProtocolBNB Chain$450K
An attacker manipulated BGM’s spot price on BNB Chain and used the inflated price to extract more than $450,000.
X319DeFi ProtocolBNB Chain$12.9K
An access-control flaw in the X319 contract let an unauthorized party extract about $12,900.
CoinPokerGamingEthereum$2M
CoinPoker’s hot wallet was compromised, and about $2 million in cryptocurrency was drained across several blockchains. The attacker moved the funds through Tornado Cash to obscure their trail.
CoWDeFi ProtocolEthereum$59K
An access-control flaw in CoW Protocol on Ethereum was exploited, causing losses of about $59,000; the reports did not specify how the flaw was used.
ChiSaleDeFi ProtocolEthereum$16.3K
A logic flaw in ChiSale’s Ethereum contract was exploited, causing about $16,300 in losses.
VRugTokenEthereum$8.4K
VRug removed liquidity from its Ethereum protocol in a rug pull, leaving users with losses.
RPPDeFi ProtocolBNB Chain$14.1K
RPP on BNB Chain was exploited through a logic flaw, causing losses of about $14,100.
MetaWinGamingEthereumSolana$4.4M
MetaWin’s hot wallets on Ethereum and Solana were compromised and drained of about $4.4 million. The platform restored 95% of user withdrawals.
Wiz KhalifaUndisclosed
Wiz Khalifa’s X account was hacked and used to post fake announcements about a WIZ token.
M2CEXEthereumSolanaBitcoin$13.7M
Attackers compromised M2 Exchange hot wallets across several blockchains and took cryptocurrency worth about $13.7 million. The exchange froze assets within 16 minutes and restored customer funds from reserves.
1inch SwapDeFi ProtocolAvalanche$723K
A malicious update to a third-party animation package injected a fake wallet-connection prompt into 1inch’s website. One user connected an Avalanche wallet and lost 10 wrapped BTC; the app’s web front end was affected.
