Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
SuperfluidDeFi ProtocolPolygon$8.7M
A flaw in Superfluid’s context checks let an attacker submit forged transaction details naming other users as senders, allowing agreement contracts to transfer their funds. About $8.7 million was taken, affecting Superfluid users and other DAOs.
Moola MarketDeFi ProtocolCelo$8.4M
The attacker manipulated the price of low-liquidity MOO tokens to make collateral appear more valuable, then borrowed assets from Moola Market. Most of the proceeds were later returned to the project.
Blizz FinanceDeFi ProtocolAvalanche$8.3M
When Chainlink’s LUNA price feed stayed at $0.10 during Terra’s collapse, attackers deposited LUNA and borrowed other assets against its overstated value from Blizz Finance. They drained the protocol’s funds.
Solana$8M
More than 8,000 Solana wallets were accessed without their owners’ knowledge, and SOL and other Solana tokens were transferred out. The cause was not identified in the reports.
UniswapDeFi ProtocolEthereum$8M
A phishing campaign airdropped malicious tokens to Uniswap users and lured them to approve transactions that gave attackers access to their assets. The attackers stole cryptocurrency and NFTs, including ETH moved through Tornado Cash.
LCXDeFi ProtocolEthereum$7.94M
Attackers gained unauthorized access to LCX’s Ethereum hot wallets and stole nearly $8 million in tokens and stablecoins. About 60% of the funds were frozen or recovered with law enforcement’s help.
Meter.ioDeFi ProtocolBridgeEthereum$7.7M
An attacker exploited a flaw in Meter’s cross-chain bridge deposit function to create fake token deposits and drain about $4.3 million. The incident also caused about $3.3 million in losses to Hundred Finance’s collateral pools.
Bitbns$7.5M
Bitbns later acknowledged that it had been hacked on February 1, but its CEO did not confirm how much was stolen. Reports disagreed on the amount and on whether the exchange initially concealed the incident.
BNSCEX$7.5M
Misconfigured AWS cloud storage exposed backups of BitBNS private keys, which attackers used to drain the exchange’s hot wallets. The theft was reportedly concealed until March 2023.
Lodestar FinanceDeFi ProtocolArbitrum$6.9M
The attacker manipulated the price of plvGLP, a token used as collateral on Lodestar Finance, then used flash loans—temporary loans repaid in the same transaction—to borrow most of the platform’s available liquidity. The protocol lost about $6.5–$6.9 million.
Hundred FinanceDeFi ProtocolGnosis Chain$6.2M
An attacker exploited a reentrancy flaw in Hundred Finance’s callback handling, repeatedly borrowing before the contract updated the debt. The attack drained more than $6 million across several markets.
FTX & 3Commas$6M
Phishing websites stole FTX users’ coins and API keys, which were then used with newly created 3Commas accounts; the keys had not come from 3Commas. FTX said it would compensate affected accounts.
AudiusDeFi ProtocolEthereum$6M
A missing safeguard in Audius’s governance contracts let an attacker repeatedly call a function and drain 18 million AUDIO tokens from the community treasury. The attacker exchanged the tokens for about 705 ETH.
Inverse FinanceDeFi ProtocolEthereum$5.8M
An attacker used a flash loan to inflate the reported value of collateral in Inverse Finance, then borrowed DOLA against it. The attack caused about $1.3 million in direct losses and $5.8 million in total protocol losses.
AgaveDeFi ProtocolGnosis Chain$5.5M
Attackers exploited a reentrancy flaw in Agave’s Gnosis Chain contracts, using flash-loaned collateral and a callback to borrow assets before balances were updated. They withdrew assets far exceeding their collateral.
AnkrDeFi ProtocolBSC$5M returned$5M
An access-control flaw in Ankr’s aBNBc staking-token contract let an attacker mint a huge number of tokens and convert about $5 million into USDC. Binance froze some funds, and Ankr said it would reimburse affected users.
OsmosisDeFi ProtocolOsmosis$5M
A flaw in Osmosis’s JoinPoolNoSwap function let liquidity providers withdraw 50% more than they had added, putting the pools at risk of being drained. The chain halted to limit losses, and Osmosis Labs said strategic reserves would cover them.
ZBCEXMulti-Chain$4.8M
ZB Exchange’s hot wallet was compromised, and multiple cryptocurrencies, including USDT, were stolen and exchanged for about 2,224 ETH. The exchange suspended deposits and withdrawals, citing a sudden failure.
Ola FinanceDeFi ProtocolFuse$4.67M
A reentrancy flaw let an attacker repeatedly withdraw collateral without repaying loans, draining Ola Finance’s markets. The stolen assets were moved to Ethereum and BNB Chain.
RaydiumDeFi ProtocolSolana$4.4M
A Trojan horse compromised Raydium pool owners’ private keys, giving the attacker administrator access to withdraw trading fees from liquidity pools. About $4.4 million was taken before Raydium patched the issue.
TerraChainTerra$4.31M
Scammers placed fake Google ads for Terra projects that led users to phishing sites asking for wallet recovery phrases. The attackers used those phrases to drain about 52 wallets, taking roughly $4.31 million.
pNetworkDeFi ProtocolBridgeBSC$4.3M
A leaked governance key in pNetwork’s pGALA bridge contract let an attacker mint and sell billions of pGALA tokens on PancakeSwap. The team intervened to remove funds from the exchange and limit losses.
Slope FinanceWalletSolana$4.1M
Slope Finance’s mobile apps sent users’ recovery phrases or private keys in plaintext to an external logging service, exposing credentials linked to 9,231 Solana wallets. Attackers drained the affected wallets.
Ahad Shams$4M
A scammer posing as an investor sent Ahad Shams a suspicious NDA and identity documents, then persuaded him to move funds to a new wallet. About $4 million in cryptocurrency disappeared from his Trust Wallet despite him not sharing his recovery phrase or private key.
DFX V2DeFi ProtocolEthereum$4M
A reentrancy flaw in DFX Finance V2’s flash-loan function let the attacker make deposits during a callback without the contract properly accounting for them as debt. The attack resulted in losses, including additional funds extracted through MEV.
Starstream Finance & AgoraDeFi ProtocolEthereum$4M
An unprotected function in Starstream Finance’s treasury contract let attackers withdraw tokens. They then used those tokens as collateral to borrow about $8.2 million from Agora.
Voltage Finance$4M
Voltage Finance was exploited through its partner Ola Finance, resulting in losses of about $4 million. The reports do not specify how the exploit worked.
XCarnivalDeFi ProtocolEthereum$3.8M
A flaw in XCarnival’s NFT collateral tracking let an attacker reuse a BAYC NFT to repeatedly borrow funds after withdrawing it, draining 3,087 ETH. The attacker later returned 1,467 ETH after negotiations.
DragomaDeFi ProtocolPolygon$3.5M
Dragoma’s team reportedly used admin privileges to withdraw funds after the token was listed on MEXC, then abandoned the project; the token’s price collapsed.
NirvanaDeFi ProtocolSolana$3.5M
The attacker used a flash loan and manipulated a price feed to buy ANA tokens at an artificially low price, then sold tokens for USDT and repaid the loan. The attack drained about $3.5 million and ANA’s price fell sharply.
Babylon Finance$3.4M
Babylon Finance lost about $3.4 million when attackers exploited a vulnerability in Rari Capital, its main lending pool. The project later announced it would shut down and distribute its remaining funds to holders.
BTC.comWalletBitcoinEthereum$3M
Attackers compromised BTC.com’s custodial systems and stole private keys, taking 32.5 BTC and 1,964 ETH. The stolen funds included about $700,000 in customer assets and $2.3 million belonging to the company; some funds were later recovered.
Skyward FinanceDeFi ProtocolNear$3M
A flaw in Skyward Finance’s treasury redemption process let an attacker buy SKYWARD tokens and redeem them for about 1.08 million NEAR, worth roughly $3 million.
Osmosis$3M
Attackers exploited a liquidity-provider flaw on Osmosis to steal about $5 million, prompting the network to shut down. Two members of a validator’s team said they exploited the bug for about $2 million and would return the funds.
Deus FinanceDeFi ProtocolFantom$3M
Attackers used a flash loan to manipulate prices in trading pools, causing the Muon price oracle to report inflated values. They exploited the resulting price data to steal about $3 million in assets.
Tinyman PoolsDeFi ProtocolAlgorand$3M
A flaw in Tinyman’s liquidity withdrawal process let attackers receive the same token twice instead of one of each pool token, extracting more liquidity than authorized. Others copied the attack, causing losses across multiple pools.
Fortress ProtocolDeFi ProtocolBSC$2.98M
An attacker passed a Fortress governance proposal with insufficient voter support to sharply raise the value of FTS collateral, then manipulated an oracle—a price data source—and borrowed against it. They took about 1,048 ETH and 400,000 DAI.
Fantasm FinanceDeFi ProtocolFantom$2.62M
A flaw in Fantasm Finance’s mint function let attackers create XFTM without providing the required collateral. They drained about 1,008 ETH from the reserve and converted the proceeds to ETH.
Tulip Protocol$2.5M
Tulip Protocol’s exposure to the Mango attack affected part of its USDC/RAY strategy treasury, involving about 2.47 million USDC and 66,722 RAY.
BXH$2.5M
A suspected stolen private key let an attacker call a function in BXH’s VaultPool contract to transfer its assets to their address, including $2.5 million in assets and 38 million BXH tokens. The attacker later moved the funds across chains and sent them to Tornado Cash.
