Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
83 incidents Clear filters
Big.gameUndisclosed
Big.game suffered a suspected rollback attack. The game reported a loss of about 8,000 EOS and moved the remaining dice prize pool to a secure account.
BetDiceUndisclosed
BetDice was hit by an attack involving transaction rollbacks; the report gives no further details about what was taken.
TRUSTBETUndisclosed
An attacker exploited a flaw in TRUSTBET's lottery randomness to replay the draw and win repeatedly, taking 11,501 EOS. The EOS was transferred to a Huobi deposit account.
ToBetDeFi ProtocolEOSUndisclosed
The attacker rolled back bet transactions, while ToBet's off-chain system briefly read the bets from a node and triggered lottery draws. The reports disagree on whether this resulted in funds being extracted.
EOS MaxDeFi ProtocolEOSUndisclosed
Attackers used EOS’s blacklist feature to reverse transactions after betting outcomes, letting players recover losing bets. The EOS MAX attacker reportedly gained 55,526 EOS, and the game was suspended.
kittyfishingUndisclosed
An attacker repeatedly used a rollback attack against the Kittyfishing game, making 91 attacks in two hours. The report does not specify what was taken.
FastwinUndisclosed
An attacker carried out 124 attacks on Fastwin’s game contract. The report does not specify what was taken or what happened to the funds.
Dice3DUndisclosed
The attacker used multiple contract accounts to submit game requests at once, placing small bets with a decoy account before increasing bets from the main account when the odds looked favorable. This allowed them to win large bonuses.
Dice3DUndisclosed
The attacker sent transaction requests from multiple accounts at once, manipulating the game so the final account had the highest chance of winning. The reports do not specify what was taken or what happened to the funds.
AtidiumUndisclosed
After Atidium’s official account was compromised, tokens including ATD were transferred out, and 130 million ATD was sent to Newdex for 3,183.8564 EOS.
nutsgamblingUndisclosed
An attacker exploited nutsgambling 144 times in under an hour, taking 1,141.71 EOS. The funds were moved through several accounts to another EOS account and had not been withdrawn to an exchange, according to the report.
BitPay CopayUndisclosed
Malicious code was added to third-party JavaScript libraries used by Copay and BitPay wallet apps, potentially exposing private keys and putting users’ Bitcoin and Bitcoin Cash at risk. The affected versions were 5.0.2 through 5.1.0.
vegasgame111Undisclosed
The attacker used a fake-EOS flaw in the quiz game contract to win hundreds of EOS. They moved the proceeds through multiple newly created accounts.
EOS LelegoDeFi ProtocolEOSUndisclosed
The attacker exploited Lelego’s predictable random-number system, using information from earlier blockchain blocks to guess game outcomes. They won 6,282.5 EOS and transferred 6,500 EOS to Binance.
LuckyGoUndisclosed
LuckyGo’s game contract was taken offline; the attacker iloveloveeos, described as a malicious contract, had been exposed in September in connection with an attack on FairDice.
MyEosVegasUndisclosed
The attacker launched 700 attacks against the MyEosVegas game contract. The reports do not specify what was taken or what happened to the funds.
EOSDiceUndisclosed
A flaw in EOSDice’s random-number system let an attacker predict game outcomes; the project had mistakenly included a seed the attacker could control.
CaseGoUndisclosed
CaseGo was attacked, but the report does not give details about the method or outcome.
GATE.IOCEXBitcoinEthereumUndisclosed
Attackers compromised StatCounter’s analytics code and inserted JavaScript that targeted Gate.io’s Bitcoin withdrawal page, replacing withdrawal addresses with their own. The code could submit withdrawal forms automatically when certain limits were exceeded.
EOSevenUndisclosed
A large amount of SVN was moved from the EOSeven game account to tuningfinish, then partly returned; tuningfinish sold SVN on Newdex and sent the resulting EOS to Binance.
MapleChangeUndisclosed
MapleChange reported a hack and temporarily disabled customer accounts while investigating. It did not specify the amount or how the funds were taken, and said it would arrange refunds based on customer reports.
EOS PokerUndisclosed
During a server expansion, EOS Poker’s operators failed to save the game’s random seed to the database. The system stopped recording seeds after game 868590.
TRADE.IOUndisclosed
Someone gained access to Trade.io’s cold-storage wallets and stole more than 50 million TIO tokens. Some of the tokens reached Bancor and Kucoin.
WORLD CONQUESTUndisclosed
A player exploited the game’s tax rules to block later buyers and end the game abnormally, taking nearly all the EOS in its fund pool.
EOSBankUndisclosed
The EOSBank contract's owner permissions were changed, and 18,000 EOS was transferred to the account fuzl4ta23d1a.
EOSBetUndisclosed
The EOSBet game contract failed to verify that transfer actions came from the EOS token contract or the game’s own token contract. The report does not specify what was taken.
EOS.WinUndisclosed
The attacker exploited a code flaw to exchange fake EOS tokens for real EOS and win without placing a bet.
EOS Happy SlotUndisclosed
An attacker replayed transactions to claim multiple winnings in a single attempt.
FairDiceUndisclosed
The attacker exploited FairDice’s time-dependent randomness: the same bet could produce different results at different times, allowing the attacker to reject losing outcomes. The reports do not specify what was taken.
DEOSBETUndisclosed
Hackers cracked the pattern used to generate random numbers in DEOSBET; the report does not say what was taken.
EOS.WinUndisclosed
An attacker cracked EOS.Win's random number generation, causing a reported loss of 2,000 EOS. The attack was not publicly disclosed at the time.
LuckyosUndisclosed
Hackers cracked the random-number pattern in Luckyos’s rock-paper-scissors game and repeatedly played rock at a chosen time to win prizes.
EOSBETUndisclosed
A malicious contract consumed EOSBET’s RAM, and the game failed to check who was calling its transfer action. This let the attacker exchange fake tokens for real ones.
Fomo 3DUndisclosed
An attacker used special techniques to take the bonus from Ethereum’s Fomo 3D game; the description does not specify how the attack worked.
Fomo 3DUndisclosed
Fomo 3D’s website was reportedly hacked, and its access and traffic fell sharply. The reports do not specify what was taken or what happened to the funds.
狼人游戏(EOS Fomo3D)Undisclosed
An overflow bug in the EOS Fomo3D game contract caused its cash pool balance to turn negative.
Litecoin CashUndisclosed
Litecoin Cash suffered a 51% attack, in which an attacker controls most of the network's mining power. The team contacted exchanges and raised the required confirmations to 100 to guard against attacks.
BAI TokenUndisclosed
A flaw in the BAI smart contract allowed tokens to be transferred from any account without its owner’s permission. The disclosure reported numerous thefts.
EDU TokenUndisclosed
A critical flaw in the EDU smart contract allowed tokens to be transferred from any account.
TAYLORUndisclosed
Taylor reported that attackers stole its ETH funds and TAY tokens from the team and bounty pools. Tokens in the founders’ and advisers’ pools were not taken because a vesting contract kept them inaccessible.
