Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
111 incidents Clear filters
BancorDeFi ProtocolEthereum$545K
A flaw in Bancor v0.6 let anyone use token approvals stored for users to transfer their funds. The team moved some funds to safety, but front-running bots took additional funds before the contract was patched.
Axion NetworkDeFi ProtocolEthereum$500K
Malicious code in Axion’s software allowed unlimited AXN minting through its unstake function. The attacker created 79 billion tokens and sold them, driving the price down and taking about 1,300 ETH.
BalancerDeFi ProtocolEthereum$500K
An attacker exploited Balancer pools’ failure to account for tokens that burn a portion of each transfer, repeatedly trading with borrowed funds to drain assets from imbalanced pools. The affected pools lost tokens including STA and STONK, as well as ETH, WBTC, LINK, and SNX.
VETHDeFi ProtocolEthereum$450K
An access-control flaw in VETH’s contract let an attacker take control of the remaining Vether and claim about 900,000 tokens. They sold 150,000 on Uniswap for roughly 15 ETH.
CoralDeFi ProtocolEOS$420K
A reentrancy bug in Coral’s wRAM contract let repeated, overlapping calls mint more tokens than intended. The attack caused a loss of more than 120,000 EOS.
OpynDeFi ProtocolEthereum$371K
A flaw in Opyn’s ETH put-option exercise function let attackers reuse one ETH payment to withdraw collateral from multiple vaults. They took 371,260 USDC from option sellers.
bZx$350K
The DeFi lending protocol bZx was exploited in an oracle attack, with reported losses of up to $350,000.
OokiDeFi ProtocolEthereum$350K
Attackers used flash loans—borrowed funds repaid within one transaction—and spread them across exchanges to manipulate wrapped Bitcoin prices reported to bZx’s oracle, a price feed with too few sources. They profited from the manipulated prices.
LedgerWalletMultiple$271K
Scammers used fake Ledger emails and websites to trick users into revealing wallet recovery details or installing malware. One reported scam stole more than 1.15 million XRP, while other victims reportedly lost their wallet balances.
SYFIDeFi ProtocolEthereum$250K
A bug in SYFI’s token rebase calculations let a trader stake a small amount and extract nearly $250,000 in gains, while the token price collapsed. The project’s contract had not been audited.
Soft Finance$250K
A user reported exploiting a vulnerability in Soft Finance and making a profit of $250,000. The report did not specify how the flaw worked or what funds were affected.
BisqDeFi ProtocolBitcoin$248K
Bisq’s fallback payout process failed to check that the destination was its legitimate donation address. Attackers substituted their own addresses and took traders’ deposits and security funds, totaling 34.86 BTC.
UniswapDeFi ProtocolEthereum$220K
An attacker exploited a reentrancy flaw in Uniswap V1’s imBTC pool, using a token callback to withdraw funds before balances were updated. The pool lost about 1,278 ETH.
SodaDeFi ProtocolEthereum$160K
A variable naming error in Soda’s WETHCalculator contract let attackers withdraw more than 400 ETH from its liquidity mining pool. The report also says the flaw was fixed.
Web3 DeFi$100K
A fake SAI-to-DAI migration app tricked users into signing transactions that sent their SAI to an attacker’s address. More than $100,000 worth of SAI was traced to the attacker.
AltsbitCEXBitcoinEthereum$70K
Attackers breached Altsbit’s hot wallets, which held almost all the exchange’s funds, and stole several cryptocurrencies, including Bitcoin and Ether. The exchange suspended operations and later closed after offering partial refunds.
Bitcoin GoldLayer 1Bitcoin Gold$70K
Attackers gained majority computing power on Bitcoin Gold and reorganized blocks to reverse exchange deposits while keeping the withdrawn coins, effectively spending them twice. The attacks involved about 7,167 BTG in total.
WLEODeFi ProtocolEthereum$42K
An attacker used WLEO’s token contract to mint unlimited tokens, then traded them for ETH from a Uniswap liquidity pool. About $42,000 worth of ETH was taken.
DDM$40K
Impersonators flooded DMM’s Telegram during its token sale and tricked people into sending them funds. DMM later sent affected users replacement DMG tokens.
HegicDeFi ProtocolEthereum$28.5K
A typo in Hegic’s options contract caused some users’ funds to remain locked after options expired. The funds were recovered and affected users were refunded.
SushiSwapDeFi ProtocolEthereum$15K
An attacker exploited a flaw in SushiSwap’s fee-distribution system by creating a malicious pool and redirecting trading fees to it. They took about $10,000–$15,000 in fees, and the project said it would compensate users from its token reserves.
Jon Prosser$4K
A hacker took over YouTuber Jon Prosser’s channel, renamed it “NASA [news]” and broadcast false Bitcoin-related claims. The stream reportedly generated about $4,000 in illegal proceeds.
Balancer$2.41K
An attacker used a flash loan—a short-term loan repaid within one transaction—to exploit a COMP trading pool in Balancer and take unclaimed COMP rewards, making a profit of 10.8 ETH.
LuckLambo104DeFi ProtocolTron$1.5K
Attackers used contracts that triggered transaction rollbacks to exploit LuckLambo104’s smart contract and redirect funds. They gained 6,588 TRX, and the contract’s balance later fell to zero.
FoxconnUndisclosed
DoppelPaymer ransomware infected about 1,200 Foxconn servers in Mexico, disrupting factory operations and stealing data while deleting backup data. Foxconn refused the ransom, and some stolen files were later published online.
PoloniexUndisclosed
A distributed denial-of-service attack overwhelmed Poloniex’s services, interrupting trading. Service resumed, and user funds were unaffected.
BTC MarketsUndisclosed
BTC Markets accidentally sent marketing emails that exposed each recipient’s full name and email address alongside those of other customers. The exchange apologized and said it was adding security measures.
Rari CapitalUndisclosed
Rari Capital fixed a vulnerability in its RGT Distributor contract and suspended related token and deposit-and-withdrawal operations while reviewing the code. The report said no funds were lost.
88mphUndisclosed
An attacker exploited a vulnerability in 88mph’s MPH token contract and obtained $100,000 in MPH tokens. A separate flaw that could have exposed ETH in a Uniswap pool was secured by moving the funds to a governance wallet.
LiquidUndisclosed
A domain-hosting provider mistakenly transferred control of Liquid’s domain account to an intruder, who changed its DNS settings and accessed internal email accounts and documents. User data was exposed, but Liquid said customer funds and its cold wallets were safe.
ElectrumSVUndisclosed
A bug in ElectrumSV’s multisignature locking script allowed an attacker to steal 600 BSV from a user.
GrinChainGrinUndisclosed
An unknown miner gained control of more than half of Grin’s computing power and reorganized at least one block, allowing the network’s transaction history to be altered. The team advised users to wait for extra transaction confirmations.
Curve FinanceUndisclosed
Scammers bought Google search ads impersonating Curve’s website and tricked a visitor into a phishing attack. The user lost 20 bitcoins.
DeFi SaverUndisclosed
Users reported that 310,000 DAI had gone missing in connection with DeFi Saver Exchange. DeFi Saver said the funds were safe and linked the issue to exchange benefits reported earlier.
bZxUndisclosed
A replay bug in bZx’s iToken contracts enabled repeated lending actions and affected about $8 million in assets. bZx patched the bug, and the attacker later returned all the funds.
Banco EstadoUndisclosed
REvil ransomware was behind a cyberattack that forced Chilean bank Banco Estado to shut down its nationwide operations.
TSEMUndisclosed
Ransomware attackers targeted Tower Semiconductor and demanded a Bitcoin ransom. The company shut down some servers and paused production at some factories.
Argentine National Immigration ServiceUndisclosed
NetWalker ransomware attackers accessed Argentina’s National Immigration Service database and stole information. The government refused to pay the ransom, which rose to 355 bitcoin.
CherryFiUndisclosed
A transfer compatibility flaw in CherryFi’s USDT handling caused funds to become locked, preventing users from transferring USDT into or out of the project.
ChainlinkUndisclosed
Attackers spammed nine Chainlink node operators and obtained about 700 ETH from their hot wallets.
