Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Data last changed · Checked daily
2,405 incidents
X100DeFi ProtocolEthereum$4.75M
An attacker used flash-borrowed funds to gain two of three seats on X100’s Senate and pass a malicious treasury proposal in the same transaction. It made the treasury sell 400,000 X tokens into the attacker’s thin pool for almost nothing, enabling the attacker to extract about $4.85 million in USDT and additional X tokens.
Polkadot$1.38M
A bug in Polkadot Asset Hub’s XCM executor let an attacker reduce dotUSD’s recorded supply without changing account balances, distorting its price in a DOT trading pool. Arbitrage trades cost the Treasury, the pool’s sole liquidity provider, about $1.381 million in DOT value; users lost no funds.
InitiaChainInitia$2.6M
A bug in Initia’s MoveVM, the software that runs its smart contracts, let an attacker mint unbacked tokens and bridge about $2.7 million in assets off the network. Initia halted its L1 blockchain and rollups; native INIT tokens were unaffected.
NEM（NemTokenV2）$822K
A flaw in the NEM token contract counted transfers to its liquidity pool as sales without checking whether swaps settled. The attacker repeatedly used this accounting error to drain pool reserves, then sold NEM at an inflated price for about $821,920 in USDT.
WAX Multi-Chain BridgeDeFi ProtocolBridgeSolanaEthereumWAX$90.5K
A WAX bridge contract accepted a negative withdrawal fee, letting an attacker trigger full withdrawals without debiting their account. The resulting records caused the bridge to release stablecoins on Solana and Ethereum, costing about $90,500; bridge processing was paused.
CoinDCXCEXTRON$16M
CoinDCX reported about $16 million in suspicious outflows from TRON addresses linked to its exchange. It attributed the losses to old addresses compromised in a previous breach that continued receiving deposits, and said it absorbed the losses and credited affected users.
Slice$41K
Slice’s FundsModule trusted caller-provided reports of released funds without checking that ETH or USDC had arrived. The attacker used contracts that reported transfers but sent no assets, then withdrew about $41,000 from pooled reserves.
Fearless Wallet$20K
Malicious code in the Fearless Wallet browser extension sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users reported unauthorized transactions totaling 17,286 DOT.
SwellDeFi ProtocolEthereumArbitrumBase+1 chainsUndisclosed
An attacker gained control of about 30 Swell operational keys, drained wallet balances, manipulated swETH and rswETH exchange rates with false reserve data, and redirected reward claims. Malicious upgrade contracts capable of draining about 2,513 ETH had been deployed but were not approved or executed.
GarudaDefiDeFi ProtocolTerra ClassicUndisclosed
Attackers repeatedly breached Garuda DeFi systems on Terra Classic, using malicious contract changes and compromised developer wallets to take user assets and rewards. They also inserted harmful wallet-approval prompts on the website; 1,114 NFTs and staking tokens were affected, with total losses undisclosed.
AlpsCon AI Trade HubDeFi ProtocolBSC$153K
AlpsCon’s contracts treated newly deposited funds as if they qualified for rewards earned before deposit. Using a publicly known test-account key and a flash loan, the attacker exploited the accounting flaw and took about $152,000 in USDC.
Argent-style Smart Wallet System$59.8K
Flaws in an Argent-style smart wallet let an attacker take ownership through a rapid recovery process and reuse signed instructions. Repeating the instructions to trade against a low-liquidity MARK/WETH pool caused about $59,800 in losses.
Vara BridgeDeFi ProtocolBridgeEthereum$12.8K
An attacker reportedly bypassed Vara Bridge’s cross-chain proof checks by submitting fraudulent Merkle roots, records used to verify messages. This allowed unauthorized messages to be processed on Ethereum and caused about $12,776 in losses.
CofferDeFi ProtocolSolana$1
Coffer’s BTC pool rounded tiny deposits down to zero but still issued liquidity-provider tokens. An attacker repeated the deposits to obtain shares without equivalent assets, diluting existing providers; the pools were paused and later fixed.
QubicWalletQubic$1.3M
Weak randomness made some Qubic wallet recovery seeds predictable, allowing an attacker to drain 1,404 wallets of about 2.94 trillion QU. The network was halted, most stolen funds were frozen, and seed generation was fixed in a wallet update.
Pirate ChainChainPirate Chain$10.7M
Two transaction-validation flaws let an attacker bypass Pirate Chain’s issuance checks and create about 39.8 million unauthorized ARRR. The tokens were moved into the shielded pool, which obscures transactions; exchanges and pools were asked to pause while a recovery plan was developed.
AffluentDeFi ProtocolTON$1.05M
A vulnerability in Affluent’s lending vaults let attackers mint shares without depositing assets, then redeem vault funds. The incident caused losses of about $1.053 million, and extracted assets were reportedly moved through exchanges, swaps, and cross-chain services.
UNCX Network V2DeFi ProtocolEthereumBaseBSC+1 chains$86K
A flaw in UNCX vesting contracts let an attacker manipulate pooled-token accounting through vesting releases, donations, and cancellations, then withdraw tokens belonging to other users. The project reported about $807,000–$808,000 extracted, with roughly $58,000 recovered by whitehats.
GamdomGambling PlatformEthereumBSCPolygon+5 chains$4.21M
After an attacker gained unauthorized access to Gamdom’s automation server, the platform’s multichain hot wallets were compromised. About $4.2 million was stolen across eight networks and moved through bridges, swaps, and other services; the precise method of wallet access was not confirmed.
PapertradeDeFi ProtocolHyperliquid L1$1.28M
An attacker moved ETH prices on Hyperliquid’s order book while trading highly leveraged positions on Papertrade, which settled against the live midpoint price without safeguards against manipulation. The trades extracted about $1.28 million from Papertrade’s shared USDC liquidity pool.
Ledger (Supply Chain)Wallet$93M
Genuine Ledger hardware wallets were secretly modified to capture recovery phrases during setup and send them over cellular connections. Attackers used the phrases to access and drain customers’ crypto; Ledger said its core systems were not compromised.
EtherVistaDeFi ProtocolEthereum$18.6K
An integer overflow in EtherVista’s pool swap check let a malicious router pass swaps that reduced the pool’s real reserves. The attacker used two crafted swaps to take WETH and VISTA worth about $18,600.
X7 Finance$16.5K
An accounting bug in X7Pioneer’s reward-claim function repeatedly counted the same ETH as rewards when no rewards were claimable. The attacker exploited this by adding ETH to the contract and drained about 6.78 ETH.
BitBay StableVaultDeFi ProtocolPolygon$14.8K
The attacker used reposition() to reduce BitBay’s vault liquidity to zero, then redeemed a tiny share. A withdrawal flaw sent the vault’s entire token balance instead of the user’s proportional share, draining about 14,838 DAI.
79th Vault$12.5M
Using a compromised operator key, the attacker moved 79AU tokens out of a PancakeSwap pool and sold them to drain its USDT. The project later recovered about 15,000 BNB through negotiations.
Locus FinanceDeFi ProtocolArbitrum$18K
MakerDAO ETH-A Liquidation Keeper BotDeFi ProtocolEthereum$538K
An unprotected drain function in a third-party MakerDAO liquidation keeper let anyone withdraw collateral from old auctions. The attacker claimed 200 WETH and sent it to an address they controlled; MakerDAO’s core contracts were not affected.
Set ProtocolDeFi ProtocolEthereum$21.9K
An upward-rounding bug in Set Protocol’s fee accounting inflated share value even when no fee was due. Attackers issued and redeemed shares to extract about 8.11 WETH from existing collateral.
Based Visa Card Internal DashboardUndisclosed
An unauthorized party accessed an internal dashboard for the Based Visa Card program, potentially obtaining some cardholders’ names, identification numbers, birth dates, and addresses. Card details, funds, and wallets were not affected.
MALT$13.4K
A flaw in MALT’s swap logic let an attacker trigger a rebalance that moved treasury DAI into the pool and treated it as their own contribution. They withdrew a disproportionate amount of MALT, causing about $72,000 in losses.
GoldPesaDeFi ProtocolBase$115K
A flaw in GoldPesa’s liquidity rebalancing let an attacker’s unpaid position draw on the protocol’s USDC credit in a shared Uniswap pool manager. The attacker withdrew about 114,900 USDC; Uniswap v4 itself was not compromised.
Microsoft’s official X accountUndisclosed
Attackers accessed Microsoft’s official X account and used it to promote an unauthorized Clippy meme coin to followers. Microsoft secured the account and removed the posts, saying it had not authorized the token.
NEAR IntentsDeFi ProtocolBridgeBSC$3.8M
A bug in how NEAR Intents’ Omni deposit and withdrawal system interacted with its smart contract allowed unauthorized withdrawals from a BNB Chain vault. The team patched the contract-side flaw, paused services, and pledged full compensation.
FlashLoopAdapter（Aave V3 Loop Safe Module）DeFi ProtocolEthereum$305K
FlashLoopAdapter’s authorization check could be fooled by a fake Safe, letting the attacker make real victim Safes execute unauthorized transactions. The attacker repaid one Safe’s Aave debt to unlock collateral and drained weETH from two Safes.
SKYDAODeFi ProtocolBSC$183K
SKYDAO’s taxed sell process caused the PancakeSwap pool to record an almost-zero SKYDAO reserve before the seller’s remaining tokens arrived. The attacker exploited the mismatch between the pool’s recorded reserves and actual balances to take USDT.
MCN Labs$92.6K
An inconsistency in MCN Labs’ LP reward accounting let the attacker claim rewards calculated using a higher token reserve than the one used to accrue them. A newly registered liquidity position claimed excess FIST, causing about $92,600 in losses.
MUSystem$36.9K
A deposit-and-withdrawal flaw let users count a first-deposit bonus twice and redeem more ETH than they had deposited. The attacker repeated the cycle across 16 addresses, draining ETH from the contract.
Fake GIWA BridgeDeFi ProtocolBridgeEthereum$2.08M
Scammers created a fake GIWA network and bridge using the chain ID expected for the real network, which had not launched. Users deposited ETH into the counterfeit bridge, and the scammers drained about 766 ETH; the legitimate GIWA contracts were not exploited.
Demex PerpDeFi ProtocolBridgeDemexEthereumBSC$192K
Demex’s bridge failed to properly verify reports of token deployments, allowing the attacker to register a low-value token as WETH and WBNB. The attacker then withdrew about $191,929 in real bridge assets while accounting for only about $10 worth of tokens.
BitgetCEXEthereumXRPTron+1 chains$387M
Attackers used access obtained through a third-party security product to issue fraudulent withdrawal commands from Bitget hot and warm wallets. About $387.5 million was transferred to attacker-controlled addresses; Bitget said private keys and cold wallets were not compromised and the incident was contained.
