Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
252 incidents Clear filters
Summer Finance$6.04M
Summer Finance’s Lazy Summer vault counted an Ark scheduled for removal in its value after a stale asset was donated to it. This inflated the share price and let an attacker drain real liquidity from depositors.
LoopscaleDeFi ProtocolSolana$5.8M
An attacker manipulated the price of RateX collateral to borrow more than it was worth, draining USDC and SOL from Loopscale. The stolen funds were later returned.
BetterBankDeFi ProtocolPulseChain$5M
An attacker exploited BetterBank’s reward mechanism, using flash loans and manipulated liquidity pools to mint tokens and swap some for ETH. About $2.7 million was returned; the attacker cashed out about $1.4 million.
ZKSwapDeFi ProtocolBridgeEthereum$5M
A flaw in ZKSwap’s emergency bridge withdrawals meant the contract did not actually verify zero-knowledge proofs, cryptographic checks of transactions. The attacker forged withdrawal proofs to inflate their balance and withdraw assets.
ZKsyncOtherzkSync Era$5M
An attacker used a compromised admin account to mint 111 million unclaimed ZK airdrop tokens through the sweepUnclaimed() function. The protocol and user funds were unaffected, and 90% of the stolen tokens were later returned.
1inchDeFi ProtocolEthereum$5M
A flaw in 1inch’s older Fusion v1 resolver contracts let an attacker exploit an integer calculation error to impersonate resolvers and make unauthorized swaps, stealing USDC and wETH. Most of the funds were recovered after negotiations.
Hyperliquid$4.95M
An attacker built a large leveraged POPCAT position and then withdrew buy orders that had supported its price, causing a sharp crash. The position was liquidated, leaving Hyperliquid’s liquidity provider with about $4.9 million in bad debt.
AdsPower$4.7M
Hackers distributed malicious code that compromised some third-party browser extensions, in a breach discovered by AdsPower’s security team.
Future ProtocolDeFi ProtocolBSC$4.6M
A flash loan let an attacker buy FPC and manipulate its pool price. FPC tokens burned from the pool then distorted its reserves, allowing the attacker to extract about $4.6 million.
CredixDeFi ProtocolSonic$4.5M
An attacker gained administrator access to Credix on Sonic and minted unbacked acUSDC tokens, then used them to drain about $4.5 million from pools. The funds were moved to Ethereum through Tornado Cash.
IoTeX$4.4M
A compromised private key gave an attacker full administrator control of IoTeX’s ioTube bridge, which was drained of $4.4 million. The attacker also minted two tokens; IoTeX said most were frozen or worthless.
Shibarium BridgeDeFi ProtocolBridgeShibarium$4.1M
An attacker used a flash loan to gain control of most Shibarium validator power and get validators to approve a false network state, draining assets from the bridge. Reports differ on the loss, describing it as several million dollars.
Suji Yan$4M
Mask Network founder Suji Yan reportedly lost more than $4 million in cryptocurrency in an apparent wallet hack.
Unleash ProtocolDeFi ProtocolStory$3.9M
An attacker manipulated Unleash Protocol’s multisig governance controls to upgrade its contract and transfer user assets, including WIP, USDC and WETH. About $3.9 million was stolen and moved to Ethereum; Story Protocol itself was unaffected.
FlowLayer 1Flow$3.9M
An attacker exploited Flow’s execution layer to mint FLOW tokens and move assets, including WBTC, WETH and stablecoins, off the network. The assets were worth about $3.9 million; existing user balances were unaffected.
Our coverage: Flow Recovers Fast: $3.9M Breach Contained, Protocol Fix DeployedSource
Force BridgeDeFi ProtocolBridgeNervos$3.9M
Force Bridge was exploited through privileged functions that lacked access controls, allowing attackers to drain assets across Ethereum and BSC. The Nervos team suspended the contracts and investigated reports of malicious code embedded in a locally built Docker image.
HyperVaultDeFi ProtocolHyperliquid L1$3.6M
HyperVault’s developers drained about $3.6 million in user funds and disappeared, moving assets through privacy tools. They had falsely claimed the project was audited by Spearbit and Pashov.
Typus FinanceDeFi ProtocolSui$3.44M
A vulnerability in Typus Finance’s price oracle let the attacker set token prices to extreme values and drain assets from its TLP contract. Stolen assets included SUI, USDC, xBTC, and suiETH.
GANA PaymentDeFi ProtocolBSC$3.1M
An attacker obtained GANA Payment’s private keys and used them to change reward rates and exploit the unstaking function, draining tokens. They moved some of the proceeds through Tornado Cash and a cross-chain bridge; some funds remained in an Ethereum address.
GriffinAIDeFi ProtocolBridgeBSC$3M
A misconfigured LayerZero bridge and compromised contract key let attackers set a fake peer and mint 5 billion unauthorized GAIN tokens on BSC. They sold about 150 million tokens for roughly $3 million before the price crashed.
Aevo$2.7M
A smart contract upgrade vulnerability enabled an attack on Aevo’s legacy Ribbon DOV vault. The attacker manipulated its price oracle—the system supplying price data—and drained about $2.7 million.
RibbonDeFi ProtocolEthereum$2.7M
An oracle upgrade left Ribbon’s legacy vaults using mismatched price decimals. The attacker exploited a publicly callable price-setting function and low collateral requirements to open undercollateralized positions and drain $2.7 million.
Nemo ProtocolDeFi ProtocolSui$2.59M
A publicly callable flash-loan function and a state-changing query function let an attacker drain Nemo Protocol’s Sui Market pool. The attacker then bridged the funds to Ethereum.
Arcadia FinanceDeFi ProtocolBase$2.5M
Attackers used a malicious router, a contract that directs swaps, to exploit Arcadia’s asset-management contracts and drain user vaults. The loss was reported at about $3.6 million.
TextureDeFi ProtocolSolana$2.2M
A vault access-control flaw let an attacker steal about $2.2 million from Texture’s lending protocol. After the project offered a bounty, the attacker returned $1.98 million and kept $220,000.
MobiusDAO$2.15M
A decimal-place bug in Mobius Token on BSC reportedly let an attacker mint 9.73 quadrillion MBU for a small amount, then sell the tokens and take about $2.15 million.
Mobius TokenDeFi ProtocolBSC$2.15M
A decimal-scaling error in Mobius Token’s minting function let an attacker create huge amounts of tokens and swap them for stablecoins, stealing about $2.15 million.
Rari CapitalDeFi ProtocolEthereum$2M
An unprotected proxy upgrade let an attacker take control of Rari Capital’s implementation contract and gain admin privileges. They used that access to borrow without collateral from its lending pools.
OlaXBTDeFi ProtocolBSC$2M
A compromise of OlaXBT’s multisignature wallet led to the theft of AIO tokens. The team deployed a replacement token contract and migrated users’ holdings.
MEV Bot$2M
A suspicious attack involving MEV bot 0xb5cb on BNB Chain caused losses of about $2 million; the reports give no further details on how it happened.
Sirio FinanceDeFi ProtocolHedera$2M
Sirio Finance was hit by a flash loan attack on Hedera, losing about $2 million. Public reports did not give details of the vulnerability.
New Gold ProtocolTokenBSC$1.9M
The attacker used a flash loan—a temporary loan repaid within one transaction—to manipulate a token-price calculation based on a trading pool’s reserves. This let them bypass purchase limits and obtain tokens at unrealistic prices; the stolen assets were moved to Ethereum.
MIN Spell$1.79M
A vulnerability in some deprecated MIN Spell V4 Cauldrons let an attacker mint MIM. The team fixed the flaw and bought back the affected MIM, offsetting the impact; other Cauldrons and user funds were not affected.
AbracadabraDeFi ProtocolEthereum$1.7M
A flaw in Abracadabra’s multi-action function let attackers bypass collateral checks and borrow MIM without enough backing, withdrawing 1.79 million tokens.
Term LabsDeFi ProtocolEthereum$1.65M
A decimal precision mismatch introduced during a tETH oracle update caused Term Finance to price the asset incorrectly and liquidate positions by mistake. The protocol recovered some of the affected ETH, leaving a net loss of about 362 ETH.
KintoDeFi ProtocolBridgeArbitrum$1.55M
A flaw in Kinto’s token contract let the attacker mint counterfeit K tokens without limit. They used the tokens to drain assets from lending pools and a trading pool.
MobyDeFi ProtocolArbitrum$1.47M
An attacker took control of the key used to upgrade Moby’s contracts and used a malicious upgrade to steal assets from liquidity pools. A whitehat recovered about $1.47 million of the stolen funds.
Kame AggregatorDeFi ProtocolSei$1.3M
A flaw in Kame Aggregator’s swap function let attackers make unauthorized calls and transfer tokens users had approved for spending, especially users with unlimited approvals. Some funds were recovered by the team and whitehat hackers.
Bitcoin MissionDeFi ProtocolArbitrum$1.3M
An unauthorized caller exploited a wrapped-BTC handling function that lacked access checks, moving about $1.3 million in wrapped Bitcoin from Bitcoin Mission.
SeedifyDeFi ProtocolBridgeBSCAvalanche$1.2M
An attacker used a compromised developer key to change Seedify’s bridge settings and mint unauthorized SFUND tokens, which were moved across chains and mostly sold on BNB Chain. About $200,000 was frozen at an exchange.
