Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
119 incidents Clear filters
YouHodlerUndisclosed
A data leak exposed YouHodler users’ personal and financial information, including bank account, passport and card details. The reports did not say that funds were stolen.
QuickBitUndisclosed
A data breach exposed some QuickBit users’ names, email and physical addresses, and card information. The exchange said about 2% of user data was accessible, but claimed it had not been copied or altered.
TronChipUndisclosed
Hackers repeatedly attacked TronChip, taking 61,867 TRX in total.
My Dash WalletUndisclosed
A malicious script embedded in My Dash Wallet sent users’ DASH balances and wallet secrets—including private keys and recovery seeds—to an external website.
TrezorUndisclosed
A person with a stolen Trezor or compatible device could use inexpensive equipment to extract its recovery seed—the words used to restore a wallet—in under five minutes. The vulnerability could not be patched.
BitmarketUndisclosed
Bitmarket abruptly shut down, citing a loss of liquidity, leaving users unable to access funds. Polish prosecutors said users lost a total of 2,300 BTC.
TKjoHFNUndisclosed
Attackers used a transaction rollback—a reversal of a transaction—to attack TKjoHFN and had made a profit, though the amount was not reported.
HiGold GameUndisclosed
An attacker repeatedly exploited HiGold Game and made a profit; the report gives no further details on the method or amount.
TLGUt5Undisclosed
An attacker repeatedly rolled back transactions involving the TLGUt5 DApp contract, taking 45,200 TRX and leaving the contract with almost no funds.
WaltonchainUndisclosed
Waltonchain’s mainnet suffered a coordinated attack. The team said it resolved the problem by upgrading the mainnet.
SPOKparkUndisclosed
Attackers used multiple contracts to carry out a rollback attack against SPOKpark, a Tron game, and made 50,845 TRX. The website later became inaccessible.
SynthetixDeFi ProtocolEthereumUndisclosed
A faulty oracle price feed reported the Korean won at 1,000 times its actual rate, and a trading bot exploited the error to generate over 37 million sETH in profits. The funds were recovered through a negotiated return and bug bounty.
yizeslotsbetUndisclosed
An error in the yizeslotsbet EOS contract’s transfer prompt was exploited, and the attacker obtained 10,000 FB tokens.
SKR EOSUndisclosed
Hackers repeatedly attacked SKR EOS using a weakness in its random-number process and earned thousands of EOS.
RouletteUndisclosed
An attacker used a self-created contract to exploit a transaction rollback flaw in the DAppRoulette contract and gained 27,000 TRX.
BETXUndisclosed
A stolen project private key gave an attacker owner privileges over BETX’s token contract, allowing them to transfer all 600 million BETX held by managers and sell the tokens on Newdex.
RemitanoUndisclosed
Remitano suspended XRP deposits and withdrawals after false XRP deposits caused losses for buyers, following complaints from users.
Poker EOSDeFi ProtocolEOSUndisclosed
Poker EOS’s private key was exposed, allowing attackers to drain more than 26,992 EOS from the game and transfer some of it to exchanges.
DiceGameUndisclosed
Attackers used a transaction rollback against DiceGame and gained 5,150 TRX.
BitoProUndisclosed
An attack on BitoPro’s XRP market caused the price to crash, and the exchange was thought to have lost about 7 million XRP. The attack method was described as a false top-up, but further details were not reported.
Wheel Of FortuneUndisclosed
An attacker used transaction rollbacks against the TRON Wheel Of Fortune DApp and took 7,856 TRX; the attack was still ongoing.
eosblue.oneUndisclosed
A malicious memo caused eosblue.one’s server to fail when parsing it, letting the attacker repeatedly win prizes or receive unusually large refunds.
TronWowDeFi ProtocolTronUndisclosed
Attackers exploited TronWow’s predictable random-number generation to predict game outcomes, making 2,167,377 TRX in profits across 1,203 attacks.
TronBankDeFi ProtocolTronUndisclosed
TronBank failed to check that tokens used in its investment function were genuine BTT. Attackers used counterfeit tokens to inflate their balances, creating roughly 170–200 million fake BTT.
IseriCoinUndisclosed
An attacker exploited a vulnerability in IseriCoin’s contract to send a large amount of tokens to their own account.
EOSlotsUndisclosed
An attacker repeatedly exploited EOSlots’ random-number system to win from the game, which then suspended operations.
DEOS GamesUndisclosed
Attackers created hundreds of accounts and made small bets through DEOS Games’ lucky-draw feature, exploiting unusually high returns to gain thousands of EOS.
EosNowUndisclosed
The attacker used multiple accounts to congest EOS transactions and disrupt the eosnowbetext quiz game, making a profit. Transaction congestion means flooding or crowding the network so other transactions are delayed.
TronCrushDeFi ProtocolTronUndisclosed
TronCrush’s transfer function allowed an address to send tokens to itself, letting an attacker create TCC tokens without backing. The same flaw affected more than 20 other contracts and DApps.
ZIONUndisclosed
An attacker exploited ZION.games, gaining more than 2,849 EOS and transferring the proceeds to Binance. The report said the method resembled an earlier attack on TGON.
TGONUndisclosed
An attacker controlled multiple accounts to repeatedly exploit TGON, earning thousands of EOS and transferring the proceeds to Binance.
BiKiUndisclosed
SMS verification codes were hijacked, allowing attackers to change passwords on 37 BiKi accounts and transfer assets from 18 of them. BiKi said it would cover the losses.
dBet GamesUndisclosed
An attacker repeatedly targeted dBet Games and made a profit; the report does not specify the amount or attack method.
EOSVegasUndisclosed
Attackers repeatedly congested EOSVegas with transactions, interfering with the game and making a profit. The attacker’s account was also reported as active in an attack on EOS Cube.
EOS CubeUndisclosed
An attacker congested EOS transactions to disrupt the cubecontract game and made a profit. Transaction congestion means crowding the network to delay or interfere with other transactions.
YUM.gamesUndisclosed
An attacker appeared to call YUM.games’ game-start function and claim a prize without placing a bet, earning a profit.
MercatoxUndisclosed
An attacker used a hard_fail attack against the Mercatox exchange and earned thousands of EOS.
LuckyGoUndisclosed
An attacker repeatedly targeted LuckyGo and made a profit of hundreds of EOS.
dBet GamesUndisclosed
Attackers repeatedly targeted dBet Games and made hundreds of EUSD, an EOS-based stablecoin, which they sold through the Newdex exchange.
nkpaymentcapUndisclosed
The attacker sent fake transfer notifications to nkpaymentcap, causing its contract to issue tokens, then exchanged those tokens for real EOS. The attacker took 50,000 EOS.
