Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
236 incidents Clear filters
Saddle Finance$11M
Saddle Finance lost $11 million in a theft, and a further $3.8 million was taken during a rescue effort by BlockSec. The available report does not describe how the attack occurred.
JBS$11M
Ransomware disrupted JBS’s operations, and the company paid cybercriminals $11 million in Bitcoin to protect its plants from further damage and limit the impact on its business.
Value DeFiDeFi ProtocolBSC$11M
A flaw in Value DeFi’s uninitialized pool contracts let an attacker take control and withdraw liquidity tokens from the pools. More than 3,000 ETH was reported lost.
YFI$11M
A flash-loan attack drained Yearn’s yDAI vault. The attacker received about $2.8 million, while the vault reportedly lost $11 million.
YearnDeFi ProtocolEthereum$11M
An attacker used flash loans and distorted exchange rates to deposit USDC and DAI into Yearn’s yDAI vault without adequate protection against price changes. The vault lost $11 million, while the attacker reportedly profited about $2.7 million.
Rari CapitalDeFi ProtocolEthereum$10M
An attacker used a flash loan and an arbitrary-call feature in Rari’s ibETH integration to make the pool believe it held more ETH than it did, then withdrew about $10–14 million in ETH.
Value DeFiDeFi ProtocolBSC$10M
An attacker reinitialized Value DeFi’s vSwap pool, gave themselves operator control, and used a recovery function to drain its liquidity tokens and associated funds. The affected pool lost BUSD and other tokens.
Punk ProtocolDeFi ProtocolEthereum$8.95M
An attacker reused an unguarded contract initialization function to change the address controlling withdrawals, draining stablecoins from Punk Protocol. A white-hat hacker recovered about $5 million; the remaining funds were reported sent to Tornado Cash.
Visor Finance$8.2M
An attacker exploited a permissions flaw in Visor Finance’s RewardsHypervisor contract to create fake staking credentials and mint more than 8.8 million VISR tokens. The attacker sold the tokens and moved proceeds through Tornado Cash.
Haven ProtocolDeFi ProtocolHaven$8.19M
Attackers exploited several flaws in Haven Protocol’s minting and conversion checks to create XHV and other tokens. The project later rolled the network back to its pre-attack state through a hard fork.
THORChainDeFi ProtocolBridgeEthereum$8M
An attacker used a custom contract to make THORChain’s Bifrost protocol accept fake deposits and refund real assets through its Ethereum router. The attacker limited the losses and requested a bug bounty.
Anyswap$7.9M
Anyswap was reported as affected in a wave of bridge incidents alongside ChainSwap, and the report said the issue had been fixed. It gives no details on the attack method or funds taken.
MultichainCEXBridgeEthereumBSCFantom$7.9M
A repeated value in signatures from two Multichain V3 router transactions let an attacker recover the router’s private key and withdraw funds from the bridge. The loss was reported at more than $7.8 million; Multichain said it would replenish the stolen liquidity and compensate providers.
BurgerSwapDeFi ProtocolBSC$7.2M
An attacker used a flash loan and a fake token to manipulate BurgerSwap’s prices, exploiting a reentrancy flaw in its contracts to make profitable swaps. About $7 million in tokens was stolen.
TSD$7.1M
An attacker gained enough voting control in TSD’s DAO to pass a proposal adding code that minted 11.8 billion TSD tokens to their account. They sold the tokens on PancakeSwap.
TSD (True Seigniorage Dollar)DeFi ProtocolBSC$7.1M
An attacker bought enough TSD governance tokens to pass a proposal replacing the token’s contract with a malicious version. It minted 11.8 billion TSD, which the attacker immediately sold on PancakeSwap.
DAO MakerDeFi ProtocolEthereum$7M
An attacker exploited a vesting system whose init() function lacked access controls, resetting settings on four token contracts and using emergencyExit to drain tokens. The tokens were sold on decentralized exchanges, and about $7 million was taken before the outflow was stopped.
FinNexusDeFi ProtocolEthereumBSC$7M
Malware reportedly exposed the private key controlling FinNexus’s FNX token contract, giving an attacker control to mint large amounts of FNX on Ethereum and BSC and sell them, causing the token price to collapse.
AlchemixDeFi ProtocolEthereum$6.5M
A deployment-script error gave Alchemix’s alETH vault an incorrect debt calculation, allowing users to withdraw collateral without repaying their loans. The pool developed a shortfall, though Alchemix said users’ funds were not lost.
Belt FinanceDeFi ProtocolBSC$6.3M
An attacker used flash loans—temporary loans repaid within one transaction—to manipulate Belt Finance’s pool ratios and exploit faulty calculations of users’ pool shares. The attack drained about $6.2 million, most of which was converted to another token and moved to Ethereum.
Our coverage: Belt Finance Latest BSC Flash Loan Exploit Victim, Damages Total $50 Million USDSourceRekt report
Bondly FinanceDeFi ProtocolEthereum$5.9M
A phishing attack exposed Bondly’s CEO’s admin credentials, allowing an attacker to mint 373 million BONDLY tokens and sell them into liquidity pools, crashing the token’s price.
RollDeFi ProtocolEthereum$5.7M
An attacker obtained Roll’s hot-wallet key and stole about $5.7 million in social tokens, then sold them on Uniswap and laundered the proceeds through Tornado Cash.
PIZZADeFi ProtocolEOS$5M
An integer overflow in PIZZA’s eCurve let an attacker create Tripool tokens without backing. They used the tokens as collateral to borrow assets from the protocol, causing about $5 million in losses.
XSURGE$5M
XSURGE’s SurgeBNB contract was attacked after the project warned of an unfixable vulnerability and urged users to leave. The attacker stole $5 million.
SurgeBNBDeFi ProtocolBSC$5M
A reentrancy flaw in SurgeBNB’s sell function let an attacker repeatedly withdraw value before balances were updated. The attack was funded by a 10,000 BNB flash loan.
THORChainDeFi ProtocolBridgeEthereum$5M
A flaw in THORChain’s Bifrost bridge let an attacker manipulate reported deposit amounts and repeatedly extract value from liquidity pools. About 4,000 ETH was lost.
GammaDeFi ProtocolEthereum$4.5M
An infinite-mint flaw in Gamma Strategies let an attacker create unlimited tokens and exchange them for other assets, causing losses of at least $4.5 million.
xTokenDeFi ProtocolEthereum$4.5M
An attacker used a flash loan to push down SNX’s price, then exploited an access-control flaw in xToken’s xSNX contract to buy SNX cheaply. The loss was estimated at $4.5 million.
Eleven FinanceDeFi ProtocolBSC$4.5M
A flaw in Eleven Finance’s emergency withdrawal function failed to burn users’ shares, allowing an attacker to withdraw repeatedly from the same position. The stolen funds were later reported returned.
ChainSwapDeFi ProtocolBridgeEthereumBSC$4.4M
A flaw in ChainSwap’s cross-chain bridge authorization checks let an attacker use addresses that were not approved to take control of projects’ Binance Smart Chain contracts. The attacker minted tokens and sold them.
ChainswapDeFi ProtocolBridgeEthereumBSC$4.4M
A flaw in ChainSwap’s cross-chain quota code let invalid, non-whitelisted addresses increase bridge limits without authorization. Attackers minted tokens for multiple projects and stole about $4 million across Ethereum and BSC.
Our coverage: Second ChainSwap Exploit Incurs $8M In LossesSourceRekt report
DAO MakerDeFi ProtocolEthereum$4M
An unprotected initialization function let an attacker reset DAO Maker’s vesting contracts and take ownership, then use an emergency withdrawal function to steal tokens intended for distribution. The tokens were exchanged for about $4 million in DAI.
DODODeFi ProtocolEthereum$3.8M
DODO’s crowdpooling contract allowed its initialization function to be called again, letting an attacker reconfigure pools with worthless tokens and drain their reserves. About $3.8 million was taken, and roughly $3.1 million was returned by trading bots.
SirenDeFi ProtocolPolygon$3.5M
A reentrancy flaw in Siren’s withdrawal function let an attacker withdraw repeatedly before balances were updated. The exploit drained assets from several Polygon liquidity pools and affected 26 liquidity-provider addresses.
Squid GamesGamingBSC$3.38M
The SQUID token allowed purchases but blocked most holders from selling. Its developers withdrew the SQUID/BNB liquidity pool and abandoned the project, leaving buyers with tokens they could not sell.
Vesper FinanceDeFi ProtocolEthereum$3.37M
An unbounded price reported by a Uniswap v3 oracle let an attacker claim excessive VUSD collateral in Vesper Lend’s Rari Fuse pool and borrow other assets. The attacker took about $3.37 million.
Ref.FinanceDeFi ProtocolNEAR$3.2M
A faulty Ref Finance contract update failed to check users’ liquidity-token balances when they removed funds from pools, allowing attackers to withdraw more than they should have. About 507,000 NEAR and 1 million REF tokens were taken.
Zabu FinanceDeFi ProtocolAvalanche$3.2M
Zabu Finance’s farm contract failed to account for token transfer fees, crediting the attacker with more ZABU than was actually transferred. The attacker withdrew 4.5 billion ZABU and sold it into liquidity pools, with losses estimated at $3.2 million.
JayPegs AutomartDeFi ProtocolEthereum$3.1M
Malicious code added to the MISO frontend redirected proceeds from JayPegs Automart’s DONA auction to the attacker’s wallet. The $3.1 million in funds was later recovered.
Bogged FinanceDeFi ProtocolBSC$3M
A flaw in Bogged Finance’s token-transfer fee calculation charged 1% instead of the intended 5%, letting an attacker manipulate staking rewards and mint 15 million BOG tokens. The team reported that about $3 million was taken from the liquidity pool.
