Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
DEUS FinanceDeFi ProtocolArbitrumBSCEthereum$6.5M
A parameter-ordering error in DEI’s burn function let an attacker misuse token approvals and steal about $6.5 million across several networks. DEI’s price fell by more than 80%.
DEI$6.3M
A bug in DEI’s token contract allowed attackers to destroy tokens improperly, causing losses across Arbitrum and BSC. The attackers later returned about 1.07 million DAI and 2,023 ETH, according to the reports.
Coins.ph$6M
The Philippine exchange Coins.ph lost 12 million XRP in a hack.
LendHubDeFi ProtocolHeco$6M
LendHub’s old and replacement lBSV tokens were both active and priced, creating an accounting flaw across its lending markets. An attacker exploited it to redeem collateral in one market and borrow in another, taking nearly $6 million.
Earning.farm$5.15M
Earning.farm’s USDC vault was exploited, losing about 5.15 million USDC. The report does not give details of how the attack worked.
Poly NetworkDeFi ProtocolBridgeEthereumBSCPolygon$5M
Attackers forged Relay Chain block headers and validator signatures to create cross-chain transactions across 11 blockchains, minting tokens and taking over $10 million in mainstream assets. Limited liquidity and a Tether freeze of $33 million in USDT restricted further cash-outs.
ParaSpaceNFTfiEthereum$5M returned$5M
A price manipulation flaw in ParaSpace’s AutoCompoundApe contract could have let an attacker borrow against too little NFT collateral. BlockSec stopped the attack and recovered about 2,900 ETH worth of BAYC NFTs; ParaSpace said no NFTs were lost and losses were minimal.
Sherlock$4.5M
After Euler Finance was attacked, Sherlock—Euler’s auditor and insurance partner—approved a payment of $4.5 million to Euler.
SwissBorg$4.5M
SwissBorg’s Earn strategy suffered partial losses in ETH and USDT due to the Euler Finance attack. SwissBorg said it would cover the losses.
LastPass$4.4M
Funds were drained from more than 25 victims in connection with the LastPass hack, with about $4.4 million taken on the reported day.
TerraportDeFi ProtocolTerra Classic$4M
An access-control flaw let the attacker manipulate DND token pricing and drain Terraport’s liquidity pools. LUNC, USTC and TERRA tokens were taken.
Kokomo FinanceDeFi ProtocolOptimism$4M
Kokomo Finance developers carried out an exit scam, changing the cBTC reward token contract to a malicious version and halting borrowing before taking about $4 million in user funds. The project then removed its website and social media.
Patricio Worthalter$3.83M
A phishing attack on POAP founder Patricio Worthalter’s address led to the transfer of 85,898 RPL to decentralized exchanges, where the tokens were sold for 1,802 ETH.
Rocket PoolTokenEthereum$3.8M
A phishing attack tricked a major Rocket Pool token holder into losing 85,900 RPL tokens. The attacker exchanged them for ETH and spread the proceeds across multiple addresses.
dForceDeFi ProtocolArbitrumOptimism$3.65M
A read-only reentrancy flaw in dForce’s Curve vaults on Arbitrum and Optimism let the attacker manipulate a pool’s displayed price during withdrawals and liquidate users’ wstETH/ETH positions. The attacker returned the funds, and dForce said affected users would be compensated.
EralendDeFi ProtocolzkSync Era$3.4M
A read-only reentrancy flaw let attackers manipulate EraLend’s internal price oracle and drain its USDC pool on zkSync. Loss estimates ranged from about $2.76 million to $3.4 million; other pools were reported unaffected.
Raft ProtocolDeFi ProtocolEthereum$3.3M
A rounding error in Raft’s share-token minting let an attacker use a flash loan to create unbacked R tokens. The exploit caused a net loss of about $3.3 million.
Conic FinanceDeFi ProtocolEthereum$3.3M
A flaw involving reentrant price checks in Conic Finance’s Curve pool oracle let attackers manipulate prices and drain its ETH and crvUSD omnipools. The two attacks caused about $4.2 million in losses.
SushiSwapDeFi ProtocolEthereumArbitrumOptimism+1 chains$3.3M returned$3.3M
SushiSwap’s RouteProcessor2 contract failed to check swap-route details, letting an attacker direct trades through pools they controlled and steal about $3.3 million across several networks. About 885 ETH was later refunded.
NFT TraderDeFi ProtocolEthereum$3M
Reentrancy flaws—where a contract can be called again before a transaction finishes—in NFT Trader’s old contracts let attackers steal valuable NFT collateral. Some stolen NFTs were later recovered and returned to victims.
SwaprumDeFi ProtocolArbitrum$3M
Swaprum’s founders used a backdoor function in the smart contract to take users’ deposited liquidity-pool tokens. The stolen funds were laundered through Tornado Cash.
Orion ProtocolDeFi ProtocolBSC$3M
A reentrancy flaw in Orion Protocol’s swap logic let the attacker use a fake token to interfere with deposit handling and extract assets. The loss was contained to an internal broker account; Orion said user funds were safe.
Arena SocialFiOtherAvalanche$2.97M
An attacker exploited a share-issuance function without protection against repeated calls in one transaction. By manipulating its calculations, they bought one share and sold it for about 274,000 AVAX, draining roughly $2.97 million.
Stars Arena$2.9M
A flaw in Stars Arena’s smart contract allowed an attacker to drain about 266,104 AVAX. The attacker later returned 239,493 AVAX, with 27,610 AVAX paid as a bounty; about 1,000 AVAX was lost in a bridge transfer.
Our coverage: Security Breach Of $3 Million Hits Stars Arena Backed By AvalancheSourceRekt report
Lucky Star Currency, FSL$2.79M
Lucky Star Currency was named as one of two BSC token projects rugged that week, with combined losses of $2.79 million. The report did not explain how the project’s funds were taken.
OKX$2.7M
An upgraded OKX DEX proxy allowed attackers to call a function that transferred users’ authorized tokens. The reports said a Proxy Admin owner’s private key may have been leaked; the proxy was later removed from the trusted list.
OKX DEXDeFi ProtocolEthereum$2.7M
An attacker obtained OKX DEX’s proxy administrator key and used it to replace the contract’s code with a malicious version. This let them take ETH, USDT, and USDC from wallets that had previously approved the contract to spend their tokens.
RemitanoCEXEthereumTronBitcoinCash$2.7M
A third-party data breach exposed keys to Remitano’s hot wallets, which an attacker used to steal cryptocurrency across Ethereum, Tron, and Bitcoin Cash. Tether froze an address holding $1.4 million in USDT.
Shibarium Bridge$2.6M
A faulty Shibarium bridge left about $2.6 million in user funds stuck after the network’s launch.
Atlantis LoansDeFi ProtocolBSC$2.5M
An attacker passed a malicious governance proposal to gain control of Atlantis Loans’ contract, then added a backdoor to transfer assets from users who had approved the contract. The losses were about $1 million.
CoinSpotCEXEthereum$2.4M
An attacker used a compromised private key for CoinSpot hot wallets—online wallets used for quick access—to take ETH, then converted it to BTC and spread it across multiple wallets.
PlatypusDeFi ProtocolAvalanche$2.2M
Attackers used flash loans—temporary borrowed funds—to manipulate swap-price calculations across Platypus Finance’s liquidity pools and drain about $2.2 million. The project later recovered most of the stolen funds, reducing its reported net loss to about 18,000 AVAX.
Pond0xTokenEthereum$2.2M
Pond0x’s directTransfer function lacked authorization checks, allowing anyone to move tokens from other users’ accounts to their own. Traders lost tokens as people exploited the flaw.
Tornado CashDAOEthereum$2.17M
A malicious Tornado Cash governance proposal gave its attacker enough voting power to take control of governance. The attacker withdrew 483,000 TORN from governance vaults and later proposed reversing the attack.
MEV Bot$2.15M
An MEV bot’s arbitrage function had no access check, so an attacker used it to trade the bot’s tokens against a Curve pool and profit from a flash loan, a temporary borrowed sum. The bot lost about 1,000 ETH.
Kannagi FinanceDeFi ProtocolzkSync EraEthereum$2.13M
Kannagi Finance’s deployed contracts contained malicious code that drained nearly all value from the protocol, leaving about $0.17 in total value locked. The team then deleted its online presence.
Onyx ProtocolDeFi ProtocolEthereum$2.1M
An attacker used a flash loan to inflate the exchange rate in Onyx Protocol’s new PEPE lending market, exploiting rounding errors when redeeming assets and taking about $2.1 million.
Zunami ProtocolDeFi ProtocolEthereum$2.1M
An attacker manipulated Zunami Protocol’s pricing and withdrew about $2.1–$2.2 million in value. The stolen ETH was later transferred to Tornado Cash, a service that obscures crypto transactions.
DexibleDeFi ProtocolEthereumArbitrum$2.05M
A flaw in Dexible V2’s selfSwap function let an attacker make unauthorized token transfers from wallets that had approved Dexible, draining 17 users’ accounts on Ethereum and Arbitrum.
GoodDollarDeFi ProtocolEthereum$2M
A reentrancy flaw in GoodDollar’s reserve contract let an attacker repeat withdrawals before the contract updated its records. The protocol paused contracts and set a 100% transaction fee on tokens held by the attacker.
