Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
AbracadabraDeFi ProtocolEthereum$6.5M
A rounding flaw in collateral calculations let attackers bypass borrowing checks in specific Abracadabra Cauldrons and borrow MIM without authorization. The protocol reported about $6.5 million in losses, and MIM fell below its intended dollar peg.
TerraDeFi ProtocolTerra2$6.4M
A June upgrade reintroduced a known reentrancy flaw—a bug that lets an attacker repeat an operation before it finishes—in Terra’s IBC hooks module. The attacker minted tokens and swapped them on Astroport for cross-chain assets, including USDC and Astroport tokens, before the chain was halted and patched.
Astroport$6.4M
A vulnerability in Astroport’s Terra network exchange, previously patched but accidentally restored in a June upgrade, was exploited. The attack caused losses of about $6.4 million.
SenecaDeFi ProtocolEthereumArbitrum$6.4M
A flaw in Seneca’s token approvals let an attacker use crafted transaction data to transfer tokens authorized to the protocol’s contract, taking more than 1,900 ETH and senUSD. About 80% of the funds were later returned.
RemiliaNFTfiEthereum$6M
Attackers breached Remilia’s wallets and multisignature treasury after credentials stored in a password manager were reportedly compromised. They stole about 490 ETH, USDC, and more than 130 Milady NFTs, along with other NFTs and tokens; the assets were valued at over $6 million.
DeltaPrimeDeFi ProtocolArbitrum$5.98M
An attacker who obtained DeltaPrime Blue’s ProxyAdmin private key used it to replace pool contract code with malicious versions, then drained USDC, WBTC, and WETH pools on Arbitrum.
EigenLayer InvestorDeFi ProtocolEthereum$5.7M
An attacker compromised an email thread about an investor’s token custody and impersonated a legitimate party to redirect 1,673,645 EIGEN tokens to an attacker-controlled address. The tokens were sold, and some proceeds were frozen; the incident did not involve a flaw in the protocol or token contracts.
TruflationOther$5.2M
Malware stole private keys from Truflation’s operational systems, allowing attackers to drain treasury and personal wallets across multiple blockchains. They took TRUF tokens, ETH, and DAI worth about $5 million.
PolyNetworkDeFi ProtocolBridgePolyNetwork$5M
An undisclosed vulnerability in Poly Network’s cross-chain management contract was used to drain $4–5 million in wrapped assets on Neo N3, disrupting the value of related Flamingo assets. The bridge was suspended.
LoopringDeFi ProtocolLoopring$5M
Attackers compromised Loopring’s two-factor authentication service and used it to impersonate wallet owners, reset ownership, and withdraw assets from Smart Wallets that relied on a single guardian. The reported loss was about $5 million.
Shezmu$4.9M
An attacker exploited a flaw in Shezmu that allowed anyone to create collateral and borrow ShezUSD. After negotiating a bounty with the platform, the attacker returned the funds, which Shezmu said it had recovered.
DeltaPrimeDeFi ProtocolArbitrumAvalanche$4.8M
On Arbitrum and Avalanche, an attacker created a malicious trading pair and used it to turn borrowed collateral into fake reward tokens, which they withdrew. The attack left DeltaPrime with unbacked debt.
Super Sushi SamuraiGamingBlast$4.8M
A flaw in Super Sushi Samurai’s token minting let an attacker exploit token transfers and drain the game’s liquidity pool. The attacker later returned the funds, keeping a 5% bounty.
Tapioca DAODeFi ProtocolArbitrum$4.7M
An attacker obtained a Tapioca DAO contributor’s private keys through social engineering and malware, then used them to control vesting contracts and drain funds from stablecoin pools. Some funds were recovered.
DuelbitsCEXEthereum$4.6M
Attackers compromised Duelbits’ hot-wallet keys on Ethereum and BNB Chain, stealing USDT, APE, and SHIB. They converted the tokens to ETH and laundered the funds through Tornado Cash.
GammaDeFi ProtocolArbitrum$4.5M
A flaw in Gamma’s deposit settings let an attacker manipulate asset prices and mint too many liquidity-provider tokens, draining about $4.5 million from vaults.
Our coverage: Gamma Strategies Response To The Security BreachSourceRekt report
Radiant CapitalDeFi ProtocolArbitrum$4.5M
Attackers used flash loans to exploit a rounding flaw in Radiant Capital’s burn function shortly after a USDC market opened on Arbitrum. They extracted about 1,900 ETH beyond legitimate deposits.
MetaWinGamingEthereumSolana$4.4M
MetaWin’s hot wallets on Ethereum and Solana were compromised and drained of about $4.4 million. The platform restored 95% of user withdrawals.
ALEX LabDeFi ProtocolBridgeStacks$4.3M
A phishing attack compromised the private key for ALEX Lab’s XLink bridge, allowing attackers to transfer BTC, stablecoins, and SKO tokens across the bridge. The stolen assets were worth over $4.3 million.
JRNY$4M
A wallet associated with crypto commentator JRNY was reportedly compromised, with about $4 million in assets transferred and sold. The report suggested the wallet’s private key may have leaked.
OnyxDeFi ProtocolEthereum$3.8M
Onyx’s attacker manipulated exchange rates in its low-liquidity VUSD market using a flash loan, a temporary loan that is repaid in one transaction. They also exploited missing checks in the NFTLiquidation contract to inflate rewards from self-liquidations and drain funds.
UwU LendDeFi ProtocolEthereum$3.7M
After an earlier attack, the same attacker used sUSDe tokens taken in that exploit as collateral to drain several remaining UwU Lend pools. The second attack caused losses of about $3.72 million.
Sportsbet$3.5M
Sportsbet was suspected of being attacked by the same hacker linked to the BtcTurk incident, with losses reported to exceed $3.5 million.
ShidoOtherEthereum$3.3M
An attacker used a compromised private key to take control of Shido’s staking contract, add a hidden withdrawal function, and drain 4.3 billion SHIDO tokens, converting some into ETH.
Socket$3.3M
A flaw in a newly added Socket token-swapping module let attackers use two Ethereum transactions to take funds from users who had granted the Gateway contract unlimited token spending permission. Socket later recovered 1,032 ETH and said it would issue a distribution plan.
BungeeDeFi ProtocolBridgeEthereum$3.3M
A missing check on data supplied with a swap allowed attackers to insert unauthorized token-transfer instructions into Socket’s Bungee bridge aggregator. More than 700 users lost funds.
GainTokenEthereum$3.01M
Attackers used an unauthorized mint function to create GAIN tokens and immediately sell them, causing the token’s price to crash.
Banana GunDeFi ProtocolEthereum$3M returned$3M
A flaw involving Banana Gun’s Telegram message oracle, a system that verifies messages, may have let attackers forge transfer approvals and take funds from 11 users’ wallets. The team reimbursed all affected users from its treasury.
Certik/Kraken$3M
Kraken accused security researchers from Certik of extortion after they exploited a bug in Kraken’s systems. The incident became a dispute over the vulnerability disclosure; the report does not describe any loss of funds.
FixedFloatCEX$3M
An attacker breached FixedFloat’s hosting infrastructure through a vulnerability at its hosting provider. FixedFloat suspended operations to rebuild its security systems; the report said company and user funds were unaffected.
NFPromptNFTfiEthereum$3M
Attackers compromised NFPrompt treasury and administrator wallets, taking NFP treasury and ecosystem funds as well as funds belonging to other victims. The net realized loss was about $3 million.
SUNRAY FINANCEDeFi ProtocolArbitrum$2.86M
A compromised private key let an attacker upgrade SUNRAY FINANCE’s contracts and mint a huge supply of SUN tokens. The attacker sold tokens for USDC, while SUN and ARC funds were also drained from decentralized exchange pools.
Hector NetworkDeFi ProtocolEthereum$2.7M
An attacker exploited Hector Network’s token-holder compensation contract, using a function that allowed arbitrary wallets to be marked eligible, then withdrew treasury assets. The attacker reportedly swapped the stolen USDC for ETH.
Fake Ansem$2.6M
An account impersonating Solana personality Ansem used phishing to steal funds, reportedly making more than $2.6 million.
CoinStatsOther$2.2M
Attackers broke into CoinStats internal services and external integrations, compromising private keys for 1,590 user wallets and stealing about $2.2 million.
ETHTrustFundDeFi ProtocolBase$2.1M
The ETHTrustFund developer transferred the project’s full treasury of 607 ETH to crypto mixers and deleted its websites and social media. The project was described as an exit scam, with investors losing about $2.1 million.
UnizenDeFi ProtocolEthereum$2.1M returned$2.1M
A vulnerability in an upgraded Unizen contract let attackers make unauthorized external calls and steal about $2.1 million, mainly in USDT and DAI. Some funds were recovered, and the CEO began reimbursing affected users.
Starlay FinanceDeFi ProtocolAcala$2.1M
A rounding flaw in the liquidity-index calculation for Starlay’s USDC lending pool on Acala EVM let an attacker withdraw far more than they had deposited after borrowing LDOT.
CoinPokerGamingEthereum$2M
CoinPoker’s hot wallet was compromised, and about $2 million in cryptocurrency was drained across several blockchains. The attacker moved the funds through Tornado Cash to obscure their trail.
Bedrock$2M
A flaw in Bedrock’s uniBTC exchange-rate logic allowed uniBTC to be minted at a 1:1 rate with the native token, leading to an estimated theft of about $2 million.
Our coverage: Bedrock Exploit Lets Users Swap 1 ETH For 1 BTCSourceRekt report
