Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
Unknown Gnosis Safe Wallet$7.73M
An attacker exploited an authorization bypass in a router’s multicall function to use a Gnosis Safe module to make unauthorized calls. They moved assets through a malicious Uniswap pool and redeemed them for rsETH, draining about $7.73 million.
VerusCoin$7.54M
An attacker exploited a flaw in VerusCoin’s Ethereum Bridge and drained $7.54 million. The report described it as a second attack on the bridge, following an earlier exploit.
Verus Ethereum BridgeDeFi ProtocolBridgeVerus$7.53M
An attacker used Verus-Ethereum Bridge’s import path to trigger payouts on Ethereum without matching deposits. The bridge lost about $7.54 million in assets; this was a repeat of the flaw exploited in May.
TACChainTAC$7.5M
A vulnerability in the shared Cosmos EVM precompile layer let an attacker transfer about 2.985 billion TAC from one account without authorization; no new tokens were created. TAC halted its network to contain the incident.
MEV Bot$7.5M
Attackers tricked JaredFromSubway.eth’s MEV bot into approving tokens for malicious contracts by using fake token wrappers and liquidity pools. They used those approvals to transfer out WETH, USDC and USDT, draining about $7.5 million.
JaredFromSubway MEV BotOtherEthereum$7.5M
An attacker planted fake profitable trades that led JaredFromSubway’s MEV bot to approve malicious contracts to spend its tokens. The attacker later used those approvals to sweep more than $7.5 million in WETH, USDC, and USDT and laundered the funds through Tornado Cash.
Unnamed Safe Multisig (Avalanche Trading Inventory)$7.45M
A misconfigured Avalanche multisig had granted unlimited token approvals to an address where anyone could deploy code. An MEV bot front-ran an attacker’s attempt and took about $7.45 million in assets; the bot said it would negotiate their return.
DxSaleDeFi ProtocolBSC$7.3M
An attacker used owner privileges in DxSale’s old liquidity locker contracts to lower fees, change unlock times, and withdraw funds from more than 1,400 pools. The stolen liquidity was worth about $7.3 million.
DuelbitsGambling PlatformEthereumBSCBitcoin+1 chains$7M
Duelbits hot wallets were drained across several blockchains in a suspected private-key compromise; the exact cause has not been disclosed. Most stolen assets were bridged and exchanged for ETH, then consolidated in one address, while Duelbits said user balances were unaffected.
SagaEVMChainSaga$7M
A flaw in SagaEVM’s Ethermint precompile let attackers bypass checks on IBC cross-chain messages and mint unbacked Saga Dollars. They moved about $7 million in assets before the chain was halted; Saga’s other chains were unaffected.
TrustedVolumesOtherEthereum$6.7M
Missing access controls in TrustedVolumes’ RFQ swap proxy let the attacker add themselves as an authorized order signer and forge trades, draining WETH, WBTC, USDT and USDC. About $2 million in ETH was later returned, with a similar amount reportedly retained by the attacker.
DCENT Wallet$6.57M
DCENT reported abnormal transfers from its mobile App Wallet and began an investigation. The issue was reported as limited to the software wallet, with no confirmed impact on hardware wallets.
Lazy Summer ProtocolDeFi ProtocolEthereum$6.04M
An attacker used overvalued tokens from an impaired Silo vault to inflate the reported value of Lazy Summer’s USDC vaults, then redeemed shares at the inflated price. They extracted about $6.04 million in USDC.
Keplr WalletWallet$6.01M
A vulnerability in Web3Auth’s infrastructure exposed private keys for some Keplr wallets created through Google or Apple login, enabling unauthorized transactions. Keplr and Web3Auth moved funds from exposed wallets to recovery addresses; the amount stolen before those moves was undisclosed.
Wasabi ProtocolDeFi ProtocolEthereumBaseBerachain+1 chains$5.5M
Attackers obtained Wasabi’s deployer key and used it to upgrade vaults and pools across Ethereum, Base, Berachain, and Blast, then withdraw funds. Reports put losses at roughly $5.5 million, including user funds and treasury assets.
Gravity BridgeDeFi ProtocolBridgeEthereum$5.4M
Gravity Bridge was exploited and lost about $5.4 million, mainly in USDC, ETH, and USDT. Reports differ on how the attacker gained the ability to take the assets; funds were subsequently moved through exchanges and mixers.
Cyrus FinanceDeFi ProtocolBSC$5M
The attacker used a flash loan to manipulate a PancakeSwap pool’s spot price, exploiting Cyrus Finance’s withdrawal logic to take excess liquidity from a position. They made about $516,840, which was later laundered through Tornado Cash.
AstroportDeFi ProtocolNeutron$4.9M
A Neutron governance proposal reassigned control of Astroport contracts, allowing an attacker to replace their code and withdraw their balances. Astroport’s swap and pool logic was not exploited; Terra-side contracts were unaffected.
X100DeFi ProtocolEthereum$4.75M
An attacker used flash-borrowed funds to gain two of three seats on X100’s Senate and pass a malicious treasury proposal in the same transaction. It made the treasury sell 400,000 X tokens into the attacker’s thin pool for almost nothing, enabling the attacker to extract about $4.85 million in USDT and additional X tokens.
Secret NetworkChainBridgeSecret$4.67M
A flaw in Secret Network’s bridge contract let the attacker forge deposit messages through a custom IBC channel, minting unbacked tokens that were redeemed for real assets from Axelar’s escrow. About $4.67 million in assets was drained, then moved through other networks.
Axelar Secret IBC BridgeDeFi ProtocolBridgeEthereumSecret$4.67M
An attacker forged cross-chain deposit messages through a fake IBC channel to mint unbacked saTokens, then redeemed them through a legitimate channel to drain Axelar’s escrow of about $4.67 million.
AcrossDeFi ProtocolBridgeSolana$4.5M
An attacker forged Solana deposit signals, tricking Across relayers into paying out on fake cross-chain deposits. The relayers lost about $4.5 million of their own funds; users were not affected.
DropDeFi ProtocolNeutron$4.4M
A malicious Neutron governance proposal transferred control of Drop’s dATOM converter and withdrawal-manager contracts to an attacker, who replaced their code and withdrew their balances. Drop’s liquid-staking and redemption logic was not exploited.
IoTeX’s ioTube bridgeDeFi ProtocolBridgeEthereum$4.4M
An attacker obtained the private key for ioTube’s Ethereum-side validator owner and used it to upgrade the bridge, bypassing its checks and taking control of asset contracts. They drained about $4.3 million in tokens, then converted and moved most of the funds.
GamdomGambling PlatformEthereumBSCPolygon+5 chains$4.21M
After an attacker gained unauthorized access to Gamdom’s automation server, the platform’s multichain hot wallets were compromised. About $4.2 million was stolen across eight networks and moved through bridges, swaps, and other services; the precise method of wallet access was not confirmed.
MakinaFiDeFi ProtocolEthereum$3.41M returned$4.2M
An attacker used a flash loan and flaws in Makina’s share-price oracle to manipulate pool prices and extract about $4.13 million. Some funds were later returned, including about 920 ETH after a 10% bounty deduction.
New Market TradingOtherEthereumBaseArbitrum$3.98M
A flaw in New Market Trading’s SquidRouterModule let attackers use addresses they supplied to pass permission checks, then route assets through attacker-controlled pools. They drained funds from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.
NEAR IntentsDeFi ProtocolBridgeBSC$3.8M
A bug in how NEAR Intents’ Omni deposit and withdrawal system interacted with its smart contract allowed unauthorized withdrawals from a BNB Chain vault. The team patched the contract-side flaw, paused services, and pledged full compensation.
Venus ProtocolDeFi ProtocolBSC$3.7M
An attacker directly transferred THE tokens into Venus Protocol’s BSC market to inflate its exchange rate, then used the inflated value to borrow assets. The attack extracted about $3.7 million and left the protocol with bad debt.
Aperture FinanceDeFi ProtocolEthereumBaseBSC$3.67M
A flaw in Aperture’s contracts let attackers misuse users’ existing token and liquidity-provider NFT approvals through unvalidated external calls, draining about $3.67 million across several chains. No private keys were compromised.
Bitcoin Depot$3.67M
Attackers infiltrated Bitcoin Depot’s IT systems and obtained credentials for its digital-asset settlement accounts, enabling unauthorized transfers of about 50.9 BTC. The company said customer accounts and data were unaffected.
MANTRA ChainChainMANTRA$3.6M
An unsigned-integer underflow bug in an upstream Cosmos EVM module let an attacker transfer about 720.9 million MANTRA from two MANTRA-managed wallets. The chain was halted and later patched; reports say user funds and validator keys were not compromised.
YO ProtocolDeFi ProtocolEthereum$3.6M
YO Protocol’s automated rebalance had an extremely high slippage limit, removing price-movement protection. A trade routed through high-fee Uniswap pools returned only 112,036 USDC for 3,840,651 stkGHO; the multisig bought back the position that day.
NostraDeFi ProtocolStarknet$3.5M
An attacker manipulated the price of NSTR in a thinly traded market, feeding an inflated price to Nostra’s oracle and using the tokens as collateral to borrow about $3.5 million in other assets. Nostra paused its money market while tracing funds.
Sweat FoundationDeFi ProtocolNear$3.5M
A logic flaw in the SWEAT token contract let an attacker use a custom drain contract to take tokens from foundation-controlled accounts and sell some of them. The team patched the contract and restored external users’ balances.
Volo VaultsDeFi ProtocolSui$3.5M
After a high-privilege admin key was compromised, an attacker drained Volo’s WBTC, XAUm and USDC vaults on Sui. The team recovered most of the roughly $3.5 million taken and froze the vaults to prevent further losses.
Harmony ProtocolChainBridgeHarmony$3.2M
Flaws in Harmony’s chain allowed unauthorized minting of ONE, including through replayed cross-shard receipts that credited tokens without a matching source debit. Tokens were sent to exchanges, and the team patched the chain and paused the cross-chain bridge.
Third-party Gnosis Safe Module (SquidRouterModule)$3.2M
A faulty third-party Gnosis Safe module, which victims had trusted to spend their tokens without further signatures, accepted a publicly visible string as proof and let the attacker run arbitrary transactions. Fake swaps drained about $3 million from 86 wallets; the funds were consolidated into DAI.
SquidRouterModuleDeFi ProtocolEthereumBase$3.2M
A verification flaw in SquidRouterModule treated a publicly known string as proof of a secure message, letting an attacker impersonate Gnosis Safe wallet owners and execute transactions. The attacker drained 86 vaults, consolidating about $3.2 million in DAI.
Nomic nBTC BridgeDeFi ProtocolBridgeNomic$3.15M
A bug in Nomic’s forwarding mechanism let an attacker double-spend nBTC and send unbacked vouchers to Osmosis. Osmosis and IBC were not compromised; an emergency upgrade froze 22.65 BTC in the attacker’s address.
